Edit tour

Windows Analysis Report
user.exe

Overview

General Information

Sample name:	user.exe
Analysis ID:	1579342
MD5:	9ac651562b490c1651fdd79149040bf8
SHA1:	fc17e22b0f17755ee5a665c0dc4d128e4eb6d8c2
SHA256:	c414aac5e5b64da60d998f5d82d3233204ddbe02981b8734fca6dd0b56f691cf
Tags:	exeuser-aachum
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found pyInstaller with non standard icon

Uses the Telegram API (likely for C&C communication)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect virtual machines (SGDT)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

user.exe (PID: 2448 cmdline: "C:\Users\user\Desktop\user.exe" MD5: 9AC651562B490C1651FDD79149040BF8)

user.exe (PID: 420 cmdline: "C:\Users\user\Desktop\user.exe" MD5: 9AC651562B490C1651FDD79149040BF8)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: user.exe

Virustotal: Detection: 12%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.3% probability

Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA360A3D0 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA360A3D0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA36043C0 EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,	2_2_00007FFDA36043C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1D93 EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,CRYPTO_zalloc,EVP_MAC_CTX_free,EVP_MAC_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_fetch,EVP_MAC_CTX_new,EVP_MAC_free,EVP_CIPHER_CTX_new,EVP_CIPHER_fetch,OSSL_PARAM_construct_utf8_string,OSSL_PARAM_construct_end,EVP_MAC_init,EVP_DecryptInit_ex,EVP_CIPHER_free,EVP_CIPHER_free,EVP_CIPHER_free,EVP_MAC_CTX_get_mac_size,EVP_CIPHER_CTX_get_iv_length,EVP_MAC_final,CRYPTO_memcmp,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_CTX_free,CRYPTO_free,	2_2_00007FFDA35A1D93
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35F8390 CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35F8390
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35B2360 CRYPTO_THREAD_run_once,	2_2_00007FFDA35B2360
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A198D CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FFDA35A198D
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35BE427 CRYPTO_THREAD_write_lock,	2_2_00007FFDA35BE427
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A23DD EVP_MD_get_size,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_clear_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FFDA35A23DD
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35C2410 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	2_2_00007FFDA35C2410
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1B31 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35A1B31
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3600330 CRYPTO_free,CRYPTO_strndup,	2_2_00007FFDA3600330
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A4300 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35A4300
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35EE190 CRYPTO_free,	2_2_00007FFDA35EE190
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A15E6 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,memcpy,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35A15E6
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1F55 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FFDA35A1F55
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1389 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35A1389
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35EE200 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35EE200
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35F80C0 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35F80C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35C20A0 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	2_2_00007FFDA35C20A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA36000A0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFDA36000A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35AE0AD ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,	2_2_00007FFDA35AE0AD
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35BC080 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFDA35BC080
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2527 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35A2527
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A19DD BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	2_2_00007FFDA35A19DD
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A4100 CRYPTO_free,	2_2_00007FFDA35A4100
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1361 CRYPTO_malloc,EVP_PKEY_set_type,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_CTX_free,ERR_pop_to_mark,CRYPTO_free,EVP_PKEY_free,	2_2_00007FFDA35A1361
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1F28 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	2_2_00007FFDA35A1F28
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1401 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35A1401
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35EE781 CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35EE781
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2423 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35A2423
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1F3C CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FFDA35A1F3C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1CA3 CRYPTO_strdup,CRYPTO_free,	2_2_00007FFDA35A1CA3
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A25F4 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_clear_free,	2_2_00007FFDA35A25F4
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35BA6D0 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	2_2_00007FFDA35BA6D0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35E26B0 ERR_new,ERR_set_debug,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,BN_clear_free,	2_2_00007FFDA35E26B0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A162C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestSignUpdate,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,ERR_new,ERR_new,EVP_DigestSign,ERR_new,CRYPTO_malloc,EVP_DigestSign,BUF_reverse,ERR_new,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_MD_CTX_free,	2_2_00007FFDA35A162C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35E4660 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FFDA35E4660
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A16A4 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35A16A4
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A103C CRYPTO_malloc,COMP_expand_block,	2_2_00007FFDA35A103C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35EE700 CRYPTO_free,	2_2_00007FFDA35EE700
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A120D EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,	2_2_00007FFDA35A120D
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A85A0 CRYPTO_zalloc,CRYPTO_free,	2_2_00007FFDA35A85A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1488 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35A1488
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A13D9 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,	2_2_00007FFDA35A13D9
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1212 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FFDA35A1212
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3606650 EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFDA3606650
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35F8620 CRYPTO_memcmp,	2_2_00007FFDA35F8620
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A24CD CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	2_2_00007FFDA35A24CD
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35C05E0 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FFDA35C05E0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A26E4 BIO_s_file,BIO_new,ERR_new,ERR_set_debug,BIO_ctrl,ERR_new,ERR_set_debug,strncmp,ERR_new,ERR_set_debug,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	2_2_00007FFDA35A26E4
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A18B6 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35A18B6
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35D4490 CRYPTO_realloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35D4490
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1AC3 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	2_2_00007FFDA35A1AC3
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3616550 CRYPTO_memcmp,	2_2_00007FFDA3616550
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35B4530 OPENSSL_sk_num,X509_STORE_CTX_new_ex,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_new,ERR_set_debug,ERR_set_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	2_2_00007FFDA35B4530
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1ACD ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memcpy,ERR_new,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35A1ACD
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1A0F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_CIPHER_get_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,CRYPTO_memcmp,ERR_set_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_pop_to_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,strncmp,strncmp,strncmp,strncmp,strncmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FFDA35A1A0F
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3604C40 ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FFDA3604C40
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A4C00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35A4C00
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35EEC10 CRYPTO_free,	2_2_00007FFDA35EEC10
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1AB4 CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FFDA35A1AB4
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A114F CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FFDA35A114F
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35BEB48 CRYPTO_free,	2_2_00007FFDA35BEB48
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1460 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_snprintf,	2_2_00007FFDA35A1460
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35B6B20 CRYPTO_THREAD_run_once,OPENSSL_sk_find,OPENSSL_sk_value,EVP_CIPHER_fetch,EVP_CIPHER_get_flags,	2_2_00007FFDA35B6B20
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A4B30 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35A4B30
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35CEB10 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FFDA35CEB10
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A204F CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FFDA35A204F
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A17DF ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35A17DF
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1893 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_strdup,ERR_new,ERR_set_debug,	2_2_00007FFDA35A1893
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35B4990 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35B4990
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2185 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FFDA35A2185
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1A05 ERR_new,ERR_set_debug,ERR_set_error,ASN1_item_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ASN1_item_free,	2_2_00007FFDA35A1A05
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1492 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35A1492
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35E2A50 SRP_Calc_u_ex,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,BN_clear_free,BN_clear_free,	2_2_00007FFDA35E2A50
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A24EB CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FFDA35A24EB
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35F89F0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFDA35F89F0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A26B2 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	2_2_00007FFDA35A26B2
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35EE8C0 CRYPTO_free,	2_2_00007FFDA35EE8C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3618870 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA3618870
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3604860 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	2_2_00007FFDA3604860
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1EE2 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,EVP_MD_get0_name,EVP_MD_is_a,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FFDA35A1EE2
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35EE920 CRYPTO_free,	2_2_00007FFDA35EE920
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35B4930 CRYPTO_get_ex_new_index,	2_2_00007FFDA35B4930
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A139D memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	2_2_00007FFDA35A139D
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA361A8F0 EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_clear_error,ASN1_item_d2i,ASN1_TYPE_get,ERR_new,ERR_set_debug,EVP_PKEY_decrypt,ERR_new,EVP_PKEY_CTX_ctrl,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,ASN1_item_free,	2_2_00007FFDA361A8F0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA360C8E0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA360C8E0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A4FD0 CRYPTO_free,	2_2_00007FFDA35A4FD0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A20E5 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35A20E5
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2144 EVP_CIPHER_get_mode,EVP_CIPHER_get_mode,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FFDA35A2144
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2117 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	2_2_00007FFDA35A2117
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35ACEA0 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	2_2_00007FFDA35ACEA0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A17E9 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,CRYPTO_memdup,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FFDA35A17E9
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35E8E90 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FFDA35E8E90
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A117C _time64,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FFDA35A117C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A236A CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35A236A
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3612EE0 CRYPTO_memcmp,	2_2_00007FFDA3612EE0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35BEDC1 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	2_2_00007FFDA35BEDC1
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1771 CRYPTO_free,	2_2_00007FFDA35A1771
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A222F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,	2_2_00007FFDA35A222F
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1B54 memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,memcmp,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFDA35A1B54
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35BEDC1 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	2_2_00007FFDA35BEDC1
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1811 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FFDA35A1811
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35F8CA0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FFDA35F8CA0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A257C ERR_new,ERR_set_debug,CRYPTO_free,BIO_clear_flags,BIO_set_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_cleanse,	2_2_00007FFDA35A257C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35E8C80 CRYPTO_free,	2_2_00007FFDA35E8C80
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A22D9 CRYPTO_malloc,CONF_parse_list,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35A22D9
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35EEC70 CRYPTO_free,	2_2_00007FFDA35EEC70
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35E8D40 OPENSSL_cleanse,CRYPTO_free,	2_2_00007FFDA35E8D40
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1CBC EVP_MD_get_size,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35A1CBC
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35BCD30 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,EVP_MD_get0_provider,EVP_MD_free,EVP_MD_get0_provider,EVP_MD_free,EVP_CIPHER_get0_provider,EVP_CIPHER_free,EVP_MD_get0_provider,EVP_MD_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35BCD30
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A136B ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35A136B
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35AD3CA CRYPTO_free,	2_2_00007FFDA35AD3CA
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1444 EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,	2_2_00007FFDA35A1444
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA361B430 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_set_rsa_padding,OSSL_PARAM_construct_uint,OSSL_PARAM_construct_end,EVP_PKEY_CTX_set_params,EVP_PKEY_decrypt,OPENSSL_cleanse,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_CTX_free,	2_2_00007FFDA361B430
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1997 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_decapsulate,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FFDA35A1997
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1A32 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	2_2_00007FFDA35A1A32
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A195B CRYPTO_zalloc,EVP_MAC_free,EVP_MAC_CTX_free,CRYPTO_free,	2_2_00007FFDA35A195B
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1F8C CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FFDA35A1F8C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3613260 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFDA3613260
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A111D CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	2_2_00007FFDA35A111D
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35AB300 CRYPTO_clear_free,	2_2_00007FFDA35AB300
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A17F8 EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key_ex,EVP_DigestSignInit_ex,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35A17F8
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1677 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FFDA35A1677
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35D92E0 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35D92E0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35AF160 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFDA35AF160
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3601170 ERR_new,ERR_set_debug,CRYPTO_clear_free,	2_2_00007FFDA3601170
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35CD170 CRYPTO_THREAD_write_lock,OPENSSL_sk_new_null,OPENSSL_LH_delete,OPENSSL_sk_push,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,OPENSSL_sk_pop_free,	2_2_00007FFDA35CD170
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1B90 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FFDA35A1B90
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1262 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	2_2_00007FFDA35A1262
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35AD227 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35AD227
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3607230 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFDA3607230
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1A23 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FFDA35A1A23
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2374 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35A2374
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35D50D8 EVP_MAC_CTX_free,CRYPTO_free,	2_2_00007FFDA35D50D8
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A14CE CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FFDA35A14CE
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35E30A0 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FFDA35E30A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A21DF CRYPTO_memcmp,	2_2_00007FFDA35A21DF
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35C9080 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FFDA35C9080
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA361B070 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA361B070
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3605070 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA3605070
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35CF070 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,ERR_new,ERR_set_debug,memcpy,	2_2_00007FFDA35CF070
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35E9120 CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FFDA35E9120
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A11A9 EVP_MAC_CTX_free,CRYPTO_free,	2_2_00007FFDA35A11A9
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA36017A1 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FFDA36017A1
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35F77A0 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35F77A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A11BD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35A11BD
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35B7840 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FFDA35B7840
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1087 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	2_2_00007FFDA35A1087
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA36157FE CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA36157FE
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35E56D0 CRYPTO_free,	2_2_00007FFDA35E56D0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A12CB CRYPTO_THREAD_run_once,	2_2_00007FFDA35A12CB
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA360B660 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FFDA360B660
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35F1750 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFDA35F1750
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1023 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35A1023
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2469 CRYPTO_memcmp,ERR_new,ERR_set_debug,memchr,ERR_new,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35A2469
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A21E9 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	2_2_00007FFDA35A21E9
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A20F4 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35A20F4
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35F7570 CRYPTO_realloc,	2_2_00007FFDA35F7570
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3613650 CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_fetch,EVP_CIPHER_get_iv_length,RAND_bytes_ex,EVP_CIPHER_free,EVP_EncryptUpdate,EVP_EncryptFinal,ERR_new,ERR_new,CRYPTO_free,EVP_CIPHER_CTX_free,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get_iv_length,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_CIPHER_CTX_free,	2_2_00007FFDA3613650
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35AF650 EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_derive_set_peer,EVP_PKEY_is_a,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_derive,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,	2_2_00007FFDA35AF650
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35B1620 CRYPTO_free,CRYPTO_strndup,	2_2_00007FFDA35B1620
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A110E EVP_PKEY_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,	2_2_00007FFDA35A110E
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1181 CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35A1181
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2379 CRYPTO_free,	2_2_00007FFDA35A2379
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1EDD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35A1EDD
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1393 OSSL_PROVIDER_do_all,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	2_2_00007FFDA35A1393
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3613480 CRYPTO_free,CRYPTO_strndup,	2_2_00007FFDA3613480
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2126 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35A2126
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A193D CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35A193D
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35CD510 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	2_2_00007FFDA35CD510
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35F14E0 CRYPTO_memcmp,	2_2_00007FFDA35F14E0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1992 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,OPENSSL_LH_new,X509_STORE_new,CTLOG_STORE_new_ex,OPENSSL_sk_num,X509_VERIFY_PARAM_new,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,CRYPTO_secure_zalloc,RAND_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,ERR_new,ERR_set_debug,	2_2_00007FFDA35A1992
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3601B9F CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFDA3601B9F
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35CDBA0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FFDA35CDBA0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35B5BB0 OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	2_2_00007FFDA35B5BB0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35C5B90 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35C5B90
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA361BB70 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,OPENSSL_sk_push,OPENSSL_sk_num,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_value,X509_get0_pubkey,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,	2_2_00007FFDA361BB70
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A19E7 CRYPTO_free,	2_2_00007FFDA35A19E7
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1483 CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35A1483
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1582 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FFDA35A1582
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A155A ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FFDA35A155A
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35B7A60 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,strncmp,CRYPTO_free,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_delete,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	2_2_00007FFDA35B7A60
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3603A60 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	2_2_00007FFDA3603A60
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35E9A60 ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_set_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFDA35E9A60
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35EFB00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FFDA35EFB00
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35CFAF0 CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	2_2_00007FFDA35CFAF0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A11DB EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FFDA35A11DB
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A105F ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_clear_free,	2_2_00007FFDA35A105F
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35ED980 RAND_bytes_ex,CRYPTO_malloc,memset,	2_2_00007FFDA35ED980
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35F1970 ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,	2_2_00007FFDA35F1970
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA360BA20 CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA360BA20
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35E3A00 CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35E3A00
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1A15 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FFDA35A1A15
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1A41 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35A1A41
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A13DE EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_security_bits,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,EVP_PKEY_get_bn_param,EVP_PKEY_get_bn_param,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,ERR_set_debug,EVP_DigestSign,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_free,BN_free,BN_free,BN_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35A13DE
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35D38C0 CRYPTO_malloc,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,memset,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,ERR_set_debug,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_set_mark,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35D38C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A589C BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	2_2_00007FFDA35A589C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35B9870 CRYPTO_free,CRYPTO_strdup,	2_2_00007FFDA35B9870
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1E6A ERR_new,ERR_set_debug,CRYPTO_clear_free,	2_2_00007FFDA35A1E6A
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA361B900 BN_bin2bn,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA361B900
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35AF910 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,CRYPTO_malloc,EVP_PKEY_encapsulate,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_free,EVP_PKEY_CTX_free,	2_2_00007FFDA35AF910
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1654 EVP_MD_CTX_new,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_PKEY_get_id,ERR_new,EVP_MD_get0_name,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,BUF_reverse,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_MD_CTX_ctrl,ERR_new,ERR_set_debug,ERR_new,EVP_DigestVerify,ERR_new,ERR_new,ERR_new,ERR_set_debug,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	2_2_00007FFDA35A1654
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35ADFB5 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35ADFB5
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1B18 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_memcmp,ERR_new,ERR_new,	2_2_00007FFDA35A1B18
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A23EC CRYPTO_free,CRYPTO_memdup,	2_2_00007FFDA35A23EC
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A202C CRYPTO_free,	2_2_00007FFDA35A202C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35C6030 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,d2i_X509,X509_get0_pubkey,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35C6030
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1019 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFDA35A1019
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A107D CRYPTO_free,	2_2_00007FFDA35A107D
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A3EB0 CRYPTO_free,	2_2_00007FFDA35A3EB0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A25DB CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	2_2_00007FFDA35A25DB
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A150F OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	2_2_00007FFDA35A150F
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2720 CRYPTO_free,CRYPTO_strdup,	2_2_00007FFDA35A2720
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA360DF40 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,	2_2_00007FFDA360DF40
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35B5F20 CRYPTO_THREAD_run_once,	2_2_00007FFDA35B5F20
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1C53 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FFDA35A1C53
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35BBF30 CRYPTO_memcmp,	2_2_00007FFDA35BBF30
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3603F30 ERR_new,ERR_set_debug,X509_get0_pubkey,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,CRYPTO_malloc,EVP_PKEY_encrypt_init,RAND_bytes_ex,EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	2_2_00007FFDA3603F30
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2680 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FFDA35A2680
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A5EE0 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	2_2_00007FFDA35A5EE0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1D89 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFDA35A1D89
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA360BE20 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA360BE20
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2310 ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_new,EVP_MD_fetch,ERR_new,ERR_new,ERR_set_debug,EVP_MD_free,EVP_MD_get_size,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_free,CRYPTO_free,	2_2_00007FFDA35A2310
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35C5E10 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFDA35C5E10
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A108C ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFDA35A108C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35B3CC0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FFDA35B3CC0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A23F1 CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35A23F1
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35B5CB0 COMP_zlib,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	2_2_00007FFDA35B5CB0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A5C9B CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	2_2_00007FFDA35A5C9B
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35C5D20 CRYPTO_free,CRYPTO_free,	2_2_00007FFDA35C5D20
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1CEE CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	2_2_00007FFDA35A1CEE
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3603D20 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	2_2_00007FFDA3603D20
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2595 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FFDA35A2595
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA36753DC ASN1_STRING_type,ASN1_STRING_length,ASN1_STRING_get0_data,Py_BuildValue,ASN1_STRING_to_UTF8,_Py_Dealloc,Py_BuildValue,CRYPTO_free,	2_2_00007FFDA36753DC

Source: user.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: mfc140u.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3411011151.00007FFD93D57000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: user.exe, 00000002.00000002.3411559326.00007FFD941AA000.00000002.00000001.01000000.0000000E.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\_win32sysloader.pdb source: user.exe, 00000000.00000003.2148730570.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, _win32sysloader.pyd.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: user.exe, 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32ui.pdbOO source: win32ui.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb** source: user.exe, 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413952189.00007FFDA4634000.00000002.00000001.01000000.00000015.sdmp, _wmi.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: crypto\bn\bn_ctx.cBN_CTX_startBN_CTX_getossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcrypto\evp\digest.cevp_md_ctx_new_exevp_md_ctx_free_algctxevp_md_init_internalEVP_DigestUpdatesizeEVP_DigestFinal_exassertion failed: mdsize <= EVP_MAX_MD_SIZEEVP_DigestFinalXOFxoflenEVP_MD_CTX_copy_exEVP_MD_CTX_ctrlmicalgssl3-msblocksizexofalgid-absentevp_md_from_algorithmupdatecrypto\evp\m_sigver.cUNDEFdo_sigver_initEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestSignEVP_DigestVerifyFinalEVP_DigestVerifycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Fri Oct 18 00:15:00 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: _rust.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb}},GCTL source: user.exe, 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmp, pythoncom313.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32trace.pdb source: user.exe, 00000000.00000003.2149332664.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, win32trace.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32ui.pdb source: win32ui.pyd.0.dr
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\user\tb_digest.cuser_get_digestcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: _rust.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: user.exe, 00000000.00000003.2132050963.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414197760.00007FFDA5474000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: user.exe, 00000002.00000002.3411559326.00007FFD94112000.00000002.00000001.01000000.0000000E.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: user.exe, 00000000.00000003.2132050963.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414197760.00007FFDA5474000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb!! source: user.exe, 00000002.00000002.3412855086.00007FFD9F3D3000.00000002.00000001.01000000.00000019.sdmp, win32api.pyd.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: user.exe, 00000002.00000002.3411559326.00007FFD941AA000.00000002.00000001.01000000.0000000E.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb source: user.exe, 00000002.00000002.3412855086.00007FFD9F3D3000.00000002.00000001.01000000.00000019.sdmp, win32api.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: _rust.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: user.exe, 00000000.00000003.2132198027.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413689442.00007FFDA3FD5000.00000002.00000001.01000000.00000016.sdmp, VCRUNTIME140_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414439896.00007FFDA54B3000.00000002.00000001.01000000.0000000C.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: mfc140u.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: user.exe, 00000002.00000002.3413597400.00007FFDA36E3000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb source: user.exe, 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414328389.00007FFDA5496000.00000002.00000001.01000000.00000010.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413478524.00007FFDA36BB000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414106726.00007FFDA4DA3000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb source: user.exe, 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmp, pythoncom313.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413478524.00007FFDA36BB000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413866301.00007FFDA433D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413952189.00007FFDA4634000.00000002.00000001.01000000.00000015.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413777754.00007FFDA4169000.00000002.00000001.01000000.0000000B.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408463161.000001F8471B0000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: user.exe, 00000002.00000002.3412055684.00007FFD94678000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: user.exe, 00000000.00000003.2132198027.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413689442.00007FFDA3FD5000.00000002.00000001.01000000.00000016.sdmp, VCRUNTIME140_1.dll.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: user.exe, 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: user.exe, 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmp, _ssl.pyd.0.dr

Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715759280 FindFirstFileExW,FindClose,	0_2_00007FF715759280
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715771874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF715771874
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF7157583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7157583C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715759280 FindFirstFileExW,FindClose,	2_2_00007FF715759280
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715771874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF715771874
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF7157583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF7157583C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD9F3C3540 PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyList_New,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindFirstFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyObject_FromWIN32_FIND_DATAW@@YAPEAU_object@@PEAU_WIN32_FIND_DATAW@@@Z,PyList_Append,_Py_Dealloc,FindNextFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindClose,_Py_Dealloc,	2_2_00007FFD9F3C3540

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFD9F3C53D0 PyArg_ParseTuple,GetLogicalDriveStringsW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,GetLogicalDriveStringsW,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W_J@Z,

2_2_00007FFD9F3C53D0

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: api.telegram.org

Source: user.exe, 00000002.00000002.3409928858.000001F8482A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2147833873.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DEB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2147833873.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DEB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: user.exe, 00000002.00000002.3409186030.000001F847D58000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlI
Source: user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlh
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlR
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2147833873.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DEB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: libcrypto-3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DEB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: user.exe, 00000002.00000002.3409847357.000001F8481A0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.2160160747.000001F847D8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: user.exe, 00000002.00000002.3408755287.000001F847852000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2160740290.000001F84786A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8477E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.est
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DEB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2147833873.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DEB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2147833873.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: user.exe, 00000002.00000002.3409186030.000001F847D58000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/L
Source: user.exe, 00000002.00000002.3409767823.000001F8480A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: user.exe, 00000002.00000002.3409186030.000001F847D58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2141778075.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DEB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2138529718.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2139649931.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: user.exe, 00000002.00000002.3409186030.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: user.exe, 00000002.00000002.3409026139.000001F847990000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: user.exe, 00000002.00000002.3410228590.000001F848C44000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410407213.000001F848D50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8198088572:AAHwnTyia_2pAX94h0pkYLAjGks3YjPwP0M/sendMessage
Source: _cffi_backend.cp313-win_amd64.pyd.0.dr	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io
Source: METADATA.0.dr	String found in binary or memory: https://cryptography.io/
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: _rust.pyd.0.dr	String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: user.exe, 00000002.00000003.2158458420.000001F847826000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8477E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: user.exe, 00000002.00000002.3408674360.000001F847590000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: user.exe, 00000002.00000002.3408336405.000001F847124000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: user.exe, 00000002.00000002.3408336405.000001F847124000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: user.exe, 00000002.00000002.3409928858.000001F8482A0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410010250.000001F8483D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/socket.html#socket.socket.connect_ex
Source: user.exe, 00000002.00000002.3409026139.000001F847990000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: user.exe, 00000002.00000003.2160391877.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: user.exe, 00000002.00000002.3410228590.000001F848C10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
Source: user.exe, user.exe, 00000002.00000002.3412888104.00007FFD9F3E1000.00000002.00000001.01000000.00000019.sdmp, user.exe, 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmp, user.exe, 00000002.00000002.3410958266.00007FFD93C96000.00000002.00000001.01000000.00000018.sdmp, win32api.pyd.0.dr, pythoncom313.dll.0.dr, win32trace.pyd.0.dr, win32ui.pyd.0.dr, _win32sysloader.pyd.0.dr	String found in binary or memory: https://github.com/mhammond/pywin32
Source: user.exe, 00000002.00000002.3410228590.000001F848BDC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: METADATA.0.dr, _rust.pyd.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: _rust.pyd.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: _rust.pyd.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: user.exe, 00000002.00000002.3408336405.000001F847124000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: user.exe, 00000002.00000003.2157638573.000001F8477A6000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157728627.000001F8477B8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157877021.000001F847795000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F847768000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157782225.000001F847769000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157689910.000001F847768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: user.exe, 00000002.00000002.3409767823.000001F8480A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
Source: user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: user.exe, 00000002.00000002.3409026139.000001F847990000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: user.exe, 00000002.00000002.3408755287.000001F847690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: user.exe, 00000002.00000002.3409767823.000001F8480A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: user.exe, 00000002.00000002.3409767823.000001F8480A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: user.exe, 00000002.00000002.3408755287.000001F847690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: user.exe, 00000002.00000002.3409928858.000001F8482A0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.2160667306.000001F848405000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157425379.000001F847765000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F847768000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157782225.000001F847769000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157689910.000001F847768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: user.exe, 00000002.00000002.3409186030.000001F847D58000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2160160747.000001F847D8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: user.exe, 00000002.00000002.3409687341.000001F847F90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata
Source: user.exe, 00000002.00000002.3408755287.000001F847852000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/#file-format
Source: user.exe, 00000002.00000002.3408755287.000001F847852000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
Source: user.exe, 00000002.00000002.3409687341.000001F847F90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: user.exe, 00000002.00000002.3408948014.000001F847890000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F84770C000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2152930488.000001F845809000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: user.exe, 00000002.00000002.3412055684.00007FFD94678000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: user.exe, 00000002.00000002.3410228590.000001F848C44000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://pypi.org/project/cryptography/
Source: user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: user.exe, 00000002.00000002.3409928858.000001F8482A0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157425379.000001F847765000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F847768000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157782225.000001F847769000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157689910.000001F847768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F8477A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: user.exe, 00000002.00000002.3409767823.000001F8480A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: user.exe, 00000002.00000002.3409105783.000001F847A90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: user.exe, 00000000.00000003.2135434533.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: user.exe, 00000000.00000003.2135511446.000001E955DF2000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2135434533.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2135390455.000001E955DF2000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmp, user.exe, 00000002.00000002.3411790282.00007FFD94254000.00000002.00000001.01000000.0000000E.sdmp, libcrypto-3.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157425379.000001F847765000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F847768000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157782225.000001F847769000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157689910.000001F847768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: user.exe, 00000002.00000002.3409186030.000001F847D58000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2160160747.000001F847D8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: user.exe, 00000002.00000002.3412055684.00007FFD94678000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8477E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFD9F3C4F70 PyArg_ParseTuple,PyEval_SaveThread,GetKeyboardState,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,

2_2_00007FFD9F3C4F70

Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD9F3C5980 PyArg_ParseTuple,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,		2_2_00007FFD9F3C5980
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD9F3C58E0 PyArg_ParseTuple,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,		2_2_00007FFD9F3C58E0

Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF7157708C8	0_2_00007FF7157708C8
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715751000	0_2_00007FF715751000
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF7157589E0	0_2_00007FF7157589E0
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715776964	0_2_00007FF715776964
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715775C00	0_2_00007FF715775C00
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715769EA0	0_2_00007FF715769EA0
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF71576DEF0	0_2_00007FF71576DEF0
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715775E7C	0_2_00007FF715775E7C
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF7157635A0	0_2_00007FF7157635A0
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715765D30	0_2_00007FF715765D30
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715761D54	0_2_00007FF715761D54
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF71576E570	0_2_00007FF71576E570
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF7157740AC	0_2_00007FF7157740AC
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF7157680E4	0_2_00007FF7157680E4
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715771874	0_2_00007FF715771874
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715759800	0_2_00007FF715759800
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715779728	0_2_00007FF715779728
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715761740	0_2_00007FF715761740
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715761F60	0_2_00007FF715761F60
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715768794	0_2_00007FF715768794
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF71575A2DB	0_2_00007FF71575A2DB
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF71576DA5C	0_2_00007FF71576DA5C
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF7157639A4	0_2_00007FF7157639A4
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715761944	0_2_00007FF715761944
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715762164	0_2_00007FF715762164
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF71575ACAD	0_2_00007FF71575ACAD
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715776418	0_2_00007FF715776418
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF7157708C8	0_2_00007FF7157708C8
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF71575A474	0_2_00007FF71575A474
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715762C10	0_2_00007FF715762C10
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715773C10	0_2_00007FF715773C10
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715761B50	0_2_00007FF715761B50
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715751000	2_2_00007FF715751000
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715776964	2_2_00007FF715776964
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715769EA0	2_2_00007FF715769EA0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF71576DEF0	2_2_00007FF71576DEF0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715775E7C	2_2_00007FF715775E7C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF7157635A0	2_2_00007FF7157635A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715765D30	2_2_00007FF715765D30
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715761D54	2_2_00007FF715761D54
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF71576E570	2_2_00007FF71576E570
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF7157740AC	2_2_00007FF7157740AC
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF7157708C8	2_2_00007FF7157708C8
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF7157680E4	2_2_00007FF7157680E4
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715771874	2_2_00007FF715771874
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715759800	2_2_00007FF715759800
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715779728	2_2_00007FF715779728
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715761740	2_2_00007FF715761740
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715761F60	2_2_00007FF715761F60
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715768794	2_2_00007FF715768794
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF71575A2DB	2_2_00007FF71575A2DB
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF71576DA5C	2_2_00007FF71576DA5C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF7157639A4	2_2_00007FF7157639A4
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF7157589E0	2_2_00007FF7157589E0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715761944	2_2_00007FF715761944
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715762164	2_2_00007FF715762164
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF71575ACAD	2_2_00007FF71575ACAD
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715776418	2_2_00007FF715776418
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF7157708C8	2_2_00007FF7157708C8
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF71575A474	2_2_00007FF71575A474
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715775C00	2_2_00007FF715775C00
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715762C10	2_2_00007FF715762C10
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715773C10	2_2_00007FF715773C10
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715761B50	2_2_00007FF715761B50
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C08A30	2_2_00007FFD93C08A30
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C23230	2_2_00007FFD93C23230
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C23780	2_2_00007FFD93C23780
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C2F690	2_2_00007FFD93C2F690
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C1DA90	2_2_00007FFD93C1DA90
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C31FC0	2_2_00007FFD93C31FC0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C32300	2_2_00007FFD93C32300
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C085E0	2_2_00007FFD93C085E0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93BF8550	2_2_00007FFD93BF8550
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C384A0	2_2_00007FFD93C384A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C1CB70	2_2_00007FFD93C1CB70
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C1A880	2_2_00007FFD93C1A880
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C2ECC0	2_2_00007FFD93C2ECC0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93CB1300	2_2_00007FFD93CB1300
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93CB2270	2_2_00007FFD93CB2270
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93CB1950	2_2_00007FFD93CB1950
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD9F3C43F0	2_2_00007FFD9F3C43F0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD9F3C3930	2_2_00007FFD9F3C3930
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD9F3C3540	2_2_00007FFD9F3C3540
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA357C840	2_2_00007FFDA357C840
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3573A50	2_2_00007FFDA3573A50
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35810A0	2_2_00007FFDA35810A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1D93	2_2_00007FFDA35A1D93
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A116D	2_2_00007FFDA35A116D
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A8720	2_2_00007FFDA35A8720
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A16FE	2_2_00007FFDA35A16FE
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2617	2_2_00007FFDA35A2617
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1A0F	2_2_00007FFDA35A1A0F
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1618	2_2_00007FFDA35A1618
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3618870	2_2_00007FFDA3618870
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1EE2	2_2_00007FFDA35A1EE2
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35D8920	2_2_00007FFDA35D8920
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A117C	2_2_00007FFDA35A117C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1B54	2_2_00007FFDA35A1B54
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA361AC80	2_2_00007FFDA361AC80
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1CBC	2_2_00007FFDA35A1CBC
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A149C	2_2_00007FFDA35A149C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA360D2D0	2_2_00007FFDA360D2D0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A17F8	2_2_00007FFDA35A17F8
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A24DC	2_2_00007FFDA35A24DC
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A2702	2_2_00007FFDA35A2702
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3613650	2_2_00007FFDA3613650
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1C12	2_2_00007FFDA35A1C12
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35E5C00	2_2_00007FFDA35E5C00
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A155A	2_2_00007FFDA35A155A
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35E9A60	2_2_00007FFDA35E9A60
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35CBAE0	2_2_00007FFDA35CBAE0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35ED980	2_2_00007FFDA35ED980
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1596	2_2_00007FFDA35A1596
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A13DE	2_2_00007FFDA35A13DE
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A21C6	2_2_00007FFDA35A21C6
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1654	2_2_00007FFDA35A1654
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35C6030	2_2_00007FFDA35C6030
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1AD7	2_2_00007FFDA35A1AD7
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1546	2_2_00007FFDA35A1546
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A21E4	2_2_00007FFDA35A21E4
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35EDE50	2_2_00007FFDA35EDE50
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A1FDC	2_2_00007FFDA35A1FDC
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA367BF74	2_2_00007FFDA367BF74
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA3678734	2_2_00007FFDA3678734

Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FFDA361D32F appears 327 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FFDA361DB03 appears 45 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FFDA3573900 appears 116 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FFDA361D33B appears 43 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FFD93BF4250 appears 68 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF715752910 appears 34 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FFDA361D341 appears 1193 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FFD93BF4BF0 appears 77 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FFDA354C400 appears 47 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FFDA35A1325 appears 471 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FFDA361D425 appears 48 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FFDA3573880 appears 51 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF715752710 appears 104 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FFD93C089C0 appears 248 times

Source: unicodedata.pyd.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.0.dr

Static PE information: No import functions for PE file found

Source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2131357059.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32ui.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs user.exe
Source: user.exe, 00000000.00000002.3408114084.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32trace.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.2149332664.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32trace.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.2147833873.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.2132601731.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2132811903.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2139844041.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs user.exe
Source: user.exe, 00000000.00000003.2148730570.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2144073335.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepythoncom313.dll0 vs user.exe
Source: user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs user.exe
Source: user.exe, 00000000.00000003.2132198027.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs user.exe
Source: user.exe, 00000000.00000003.2149198471.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.2149332664.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32trace.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.2145628033.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes313.dll0 vs user.exe
Source: user.exe, 00000000.00000003.2132050963.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs user.exe
Source: user.exe	Binary or memory string: OriginalFilename vs user.exe
Source: user.exe, 00000002.00000002.3412791318.00007FFD948B0000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython313.dll. vs user.exe
Source: user.exe, 00000002.00000002.3414475344.00007FFDA54B6000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3413985072.00007FFDA4638000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3412888104.00007FFD9F3E1000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs user.exe
Source: user.exe, 00000002.00000002.3413535138.00007FFDA36C3000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3414256126.00007FFDA547A000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs user.exe
Source: user.exe, 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3413724236.00007FFDA3FD9000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs user.exe
Source: user.exe, 00000002.00000002.3411138623.00007FFD93D5C000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3413812063.00007FFDA4173000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3414141756.00007FFDA4DA6000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: OriginalFilenamepywintypes313.dll0 vs user.exe
Source: user.exe, 00000002.00000002.3408463161.000001F8471B0000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs user.exe
Source: user.exe, 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibsslH vs user.exe
Source: user.exe, 00000002.00000002.3414375655.00007FFDA549D000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3413635140.00007FFDA36EE000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3410958266.00007FFD93C96000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: OriginalFilenamepythoncom313.dll0 vs user.exe
Source: user.exe, 00000002.00000002.3413901141.00007FFDA4342000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs user.exe
Source: user.exe, 00000002.00000002.3411790282.00007FFD94254000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs user.exe

Source: classification engine

Classification label: mal60.troj.evad.winEXE@3/41@1/1

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFD9F3C3930 PyArg_ParseTuple,GetLastError,?PyWin_GetErrorMessageModule@@YAPEAUHINSTANCE__@@K@Z,FormatMessageW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,PyErr_Clear,PyArg_ParseTuple,?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,?PyWinSequence_Tuple@@YAPEAU_object@@PEAU1@PEAK@Z,malloc,PyErr_NoMemory,memset,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,FormatMessageW,PyEval_RestoreThread,PyExc_SystemError,PyErr_SetString,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,free,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,LocalFree,_Py_Dealloc,

2_2_00007FFD9F3C3930

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFD9F3C4C00 _Py_NoneStruct,PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,GetDiskFreeSpaceW,PyEval_RestoreThread,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,Py_BuildValue,

2_2_00007FFD9F3C4C00

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFD93C01330 PyArg_ParseTuple,?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z,?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z,PyObject_IsInstance,PyErr_Occurred,PyExc_TypeError,PyErr_SetString,PyObject_IsInstance,PyExc_ValueError,PyErr_Format,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_GetAttrString,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyObject_IsInstance,PyExc_ValueError,PyErr_Format,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,_Py_Dealloc,PyEval_SaveThread,CoCreateInstance,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,

2_2_00007FFD93C01330

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFD9F3CCBB0 PyArg_ParseTuple,?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z,?PyWinObject_AsResourceId@@YAHPEAU_object@@PEAPEA_WH@Z,?PyWinObject_AsResourceId@@YAHPEAU_object@@PEAPEA_WH@Z,FindResourceExW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,SizeofResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,LoadResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,LockResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,?PyWinObject_FreeResourceId@@YAXPEA_W@Z,?PyWinObject_FreeResourceId@@YAXPEA_W@Z,

2_2_00007FFD9F3CCBB0

Source: C:\Users\user\Desktop\user.exe

File created: C:\Users\user\Desktop\errors.log

Jump to behavior

Source: C:\Users\user\Desktop\user.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI24482

Jump to behavior

Source: user.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\user.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor

Source: C:\Users\user\Desktop\user.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: user.exe

Virustotal: Detection: 12%

Source: C:\Users\user\Desktop\user.exe

File read: C:\Users\user\Desktop\user.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe"
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe"
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe"	Jump to behavior

Source: C:\Users\user\Desktop\user.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\user.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: user.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: user.exe

Static file information: File size 15746174 > 1048576

Source: user.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: user.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: user.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: user.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: user.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: user.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: user.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: user.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: mfc140u.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3411011151.00007FFD93D57000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: user.exe, 00000002.00000002.3411559326.00007FFD941AA000.00000002.00000001.01000000.0000000E.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\_win32sysloader.pdb source: user.exe, 00000000.00000003.2148730570.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, _win32sysloader.pyd.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: user.exe, 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32ui.pdbOO source: win32ui.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb** source: user.exe, 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413952189.00007FFDA4634000.00000002.00000001.01000000.00000015.sdmp, _wmi.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: crypto\bn\bn_ctx.cBN_CTX_startBN_CTX_getossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcrypto\evp\digest.cevp_md_ctx_new_exevp_md_ctx_free_algctxevp_md_init_internalEVP_DigestUpdatesizeEVP_DigestFinal_exassertion failed: mdsize <= EVP_MAX_MD_SIZEEVP_DigestFinalXOFxoflenEVP_MD_CTX_copy_exEVP_MD_CTX_ctrlmicalgssl3-msblocksizexofalgid-absentevp_md_from_algorithmupdatecrypto\evp\m_sigver.cUNDEFdo_sigver_initEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestSignEVP_DigestVerifyFinalEVP_DigestVerifycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Fri Oct 18 00:15:00 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: _rust.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb}},GCTL source: user.exe, 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmp, pythoncom313.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32trace.pdb source: user.exe, 00000000.00000003.2149332664.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, win32trace.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32ui.pdb source: win32ui.pyd.0.dr
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\user\tb_digest.cuser_get_digestcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: _rust.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: user.exe, 00000000.00000003.2132050963.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414197760.00007FFDA5474000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: user.exe, 00000002.00000002.3411559326.00007FFD94112000.00000002.00000001.01000000.0000000E.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: user.exe, 00000000.00000003.2132050963.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414197760.00007FFDA5474000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb!! source: user.exe, 00000002.00000002.3412855086.00007FFD9F3D3000.00000002.00000001.01000000.00000019.sdmp, win32api.pyd.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: user.exe, 00000002.00000002.3411559326.00007FFD941AA000.00000002.00000001.01000000.0000000E.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb source: user.exe, 00000002.00000002.3412855086.00007FFD9F3D3000.00000002.00000001.01000000.00000019.sdmp, win32api.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: _rust.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: user.exe, 00000000.00000003.2132198027.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413689442.00007FFDA3FD5000.00000002.00000001.01000000.00000016.sdmp, VCRUNTIME140_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: user.exe, 00000000.00000003.2145799140.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414439896.00007FFDA54B3000.00000002.00000001.01000000.0000000C.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: mfc140u.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: user.exe, 00000002.00000002.3413597400.00007FFDA36E3000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb source: user.exe, 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: user.exe, 00000000.00000003.2132971103.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414328389.00007FFDA5496000.00000002.00000001.01000000.00000010.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413478524.00007FFDA36BB000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: user.exe, 00000000.00000003.2133211391.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3414106726.00007FFDA4DA3000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb source: user.exe, 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmp, pythoncom313.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: user.exe, 00000000.00000003.2133086787.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413478524.00007FFDA36BB000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: user.exe, 00000000.00000003.2132300774.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413866301.00007FFDA433D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: user.exe, 00000000.00000003.2133809062.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413952189.00007FFDA4634000.00000002.00000001.01000000.00000015.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: user.exe, 00000000.00000003.2133297330.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413777754.00007FFDA4169000.00000002.00000001.01000000.0000000B.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: user.exe, 00000000.00000003.2140585600.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408463161.000001F8471B0000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: user.exe, 00000002.00000002.3412055684.00007FFD94678000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: user.exe, 00000000.00000003.2132198027.000001E955DE3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3413689442.00007FFDA3FD5000.00000002.00000001.01000000.00000016.sdmp, VCRUNTIME140_1.dll.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: user.exe, 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: user.exe, 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmp, _ssl.pyd.0.dr

Source: user.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: user.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: user.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: user.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: user.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFD93C07B40 PyArg_ParseTuple,?PyWinLong_AsVoidPtr@@YAHPEAU_object@@PEAPEAX@Z,?PyWinLong_AsVoidPtr@@YAHPEAU_object@@PEAPEAX@Z,?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z,LoadLibraryW,GetProcAddress,PyExc_NotImplementedError,PyErr_Format,PyEval_SaveThread,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyEval_SaveThread,PyEval_RestoreThread,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyObject_IsSubclass,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,

2_2_00007FFD93C07B40

Source: mfc140u.dll.0.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python313.dll.0.dr	Static PE information: section name: PyRuntim

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFDA35C4331 push rcx; ret

2_2_00007FFDA35C4332

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\user.exe

Process created: "C:\Users\user\Desktop\user.exe"

Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32\pywintypes313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32\pythoncom313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI24482\unicodedata.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\user.exe

Code function: 0_2_00007FF7157576C0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF7157576C0

Source: C:\Users\user\Desktop\user.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFDA35E8816 sgdt fword ptr [rax]

2_2_00007FFDA35E8816

Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32\pywintypes313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32\pythoncom313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\user.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17263

Source: C:\Users\user\Desktop\user.exe

API coverage: 1.2 %

Source: C:\Users\user\Desktop\user.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor

Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715759280 FindFirstFileExW,FindClose,	0_2_00007FF715759280
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF715771874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF715771874
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF7157583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7157583C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715759280 FindFirstFileExW,FindClose,	2_2_00007FF715759280
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF715771874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF715771874
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF7157583C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF7157583C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD9F3C3540 PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyList_New,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindFirstFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyObject_FromWIN32_FIND_DATAW@@YAPEAU_object@@PEAU_WIN32_FIND_DATAW@@@Z,PyList_Append,_Py_Dealloc,FindNextFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindClose,_Py_Dealloc,	2_2_00007FFD9F3C3540

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFD9F3C53D0 PyArg_ParseTuple,GetLogicalDriveStringsW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,GetLogicalDriveStringsW,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W_J@Z,

2_2_00007FFD9F3C53D0

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFD9F3C6440 PyArg_ParseTuple,GetSystemInfo,PyLong_FromUnsignedLongLong,?PyWinLong_FromVoidPtr@@YAPEAU_object@@PEBX@Z,?PyWinLong_FromVoidPtr@@YAPEAU_object@@PEBX@Z,Py_BuildValue,

2_2_00007FFD9F3C6440

Source: user.exe, 00000000.00000003.2134380190.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: user.exe, 00000002.00000003.2158515942.000001F84770C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: user.exe, 00000002.00000002.3410228590.000001F848C44000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ro.kernel.qemu
Source: user.exe, 00000002.00000002.3410228590.000001F848C44000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dro.kernel.qemu
Source: user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F84770C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Source: C:\Users\user\Desktop\user.exe

Code function: 0_2_00007FF71576A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF71576A614

Source: C:\Users\user\Desktop\user.exe

2_2_00007FFD93C07B40

Source: C:\Users\user\Desktop\user.exe

Code function: 0_2_00007FF715773480 GetProcessHeap,

0_2_00007FF715773480

Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF71576A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF71576A614
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF71575C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF71575C8A0
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF71575D30C SetUnhandledExceptionFilter,	0_2_00007FF71575D30C
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF71575D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF71575D12C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF71576A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF71576A614
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF71575C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF71575C8A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF71575D30C SetUnhandledExceptionFilter,	2_2_00007FF71575D30C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF71575D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF71575D12C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C4B3F4 SetUnhandledExceptionFilter,	2_2_00007FFD93C4B3F4
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C4B20C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD93C4B20C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C4A874 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD93C4A874
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93CB3248 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD93CB3248
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93CB2C90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD93CB2C90
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD9F3D1A98 SetUnhandledExceptionFilter,	2_2_00007FFD9F3D1A98
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD9F3D0CAC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD9F3D0CAC
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD9F3D18B0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD9F3D18B0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA354FBFC SetUnhandledExceptionFilter,	2_2_00007FFDA354FBFC
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA354FA14 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDA354FA14
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA354E8FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFDA354E8FC
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35849A8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDA35849A8
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35843F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFDA35843F0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA35A212B IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDA35A212B
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFDA367339C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDA367339C

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFD9F3CDC70 PyArg_ParseTuple,PyEval_SaveThread,keybd_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,

2_2_00007FFD9F3CDC70

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFD9F3CDD10 PyArg_ParseTuple,PyEval_SaveThread,mouse_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,

2_2_00007FFD9F3CDD10

Source: C:\Users\user\Desktop\user.exe

Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe"

Jump to behavior

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFDA3547EB0 PyArg_ParseTuple,PyExc_TypeError,PyErr_SetString,GetSecurityDescriptorDacl,free,SetSecurityDescriptorDacl,GetSecurityDescriptorOwner,free,GetSecurityDescriptorGroup,free,free,free,

2_2_00007FFDA3547EB0

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFDA3548D60 PyArg_ParseTuple,PyErr_Clear,PyArg_ParseTuple,PyErr_Clear,PyArg_ParseTuple,PySequence_Check,PyExc_TypeError,PyErr_SetString,PySequence_Size,PySequence_Tuple,PyArg_ParseTuple,_Py_Dealloc,AllocateAndInitializeSid,PyExc_ValueError,PyErr_SetString,_Py_NewReference,malloc,memset,memcpy,

2_2_00007FFDA3548D60

Source: C:\Users\user\Desktop\user.exe

Code function: 0_2_00007FF715779570 cpuid

0_2_00007FF715779570

Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md__mypyc.cp313-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482\win32\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI24482 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\gen_py\3.13\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\gen_py\3.13\dicts.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\errors.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\user.exe

Code function: 0_2_00007FF71575D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF71575D010

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFD9F3C4200 PyArg_ParseTuple,GetUserNameW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,

2_2_00007FFD9F3C4200

Source: C:\Users\user\Desktop\user.exe

Code function: 0_2_00007FF715775C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF715775C00

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FFD9F3C7850 PyArg_ParseTuple,GetVersion,Py_BuildValue,

2_2_00007FFD9F3C7850

Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C03430 PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyObject_IsInstance,PyExc_ValueError,PyErr_Format,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,CreateBindCtx,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,PyEval_SaveThread,MkParseDisplayName,PyEval_RestoreThread,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,_Py_Dealloc,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,Py_BuildValue,		2_2_00007FFD93C03430
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FFD93C04620 PyArg_ParseTuple,PyEval_SaveThread,CreateBindCtx,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyEval_SaveThread,PyEval_RestoreThread,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyObject_IsSubclass,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,		2_2_00007FFD93C04620

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	11 Input Capture	2 System Time Discovery	Remote Services	11 Input Capture	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	2 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Native API	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	26 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
user.exe	12%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\mfc140u.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\win32ui.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\_cffi_backend.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\python313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32\pythoncom313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32\pywintypes313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\win32\_win32sysloader.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\win32\win32api.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI24482\win32\win32trace.pyd	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://github.com/asweigart/pyperclip/issues/55	user.exe, 00000002.00000002.3410228590.000001F848C10000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/pyca/cryptography/issues/8996	_rust.pyd.0.dr	false	high
https://api.telegram.org/bot	user.exe, 00000002.00000002.3409026139.000001F847990000.00000004.00001000.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot8198088572:AAHwnTyia_2pAX94h0pkYLAjGks3YjPwP0M/sendMessage	user.exe, 00000002.00000002.3410228590.000001F848C44000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410407213.000001F848D50000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/mhammond/pywin32	user.exe, user.exe, 00000002.00000002.3412888104.00007FFD9F3E1000.00000002.00000001.01000000.00000019.sdmp, user.exe, 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmp, user.exe, 00000002.00000002.3410958266.00007FFD93C96000.00000002.00000001.01000000.00000018.sdmp, win32api.pyd.0.dr, pythoncom313.dll.0.dr, win32trace.pyd.0.dr, win32ui.pyd.0.dr, _win32sysloader.pyd.0.dr	false	high
http://repository.swisssign.com/0	user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/pyca/cryptography/actions?query=workflow%3ACI	user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	high
https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file	user.exe, 00000002.00000002.3408755287.000001F847852000.00000004.00000020.00020000.00000000.sdmp	false	high
https://tools.ietf.org/html/rfc2388#section-4.4	user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.apache.org/licenses/LICENSE-2.0	user.exe, 00000000.00000003.2135511446.000001E955DF2000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2135434533.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2135390455.000001E955DF2000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	false	high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	user.exe, 00000002.00000003.2158458420.000001F847826000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8477E5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://packaging.python.org/en/latest/specifications/entry-points/#file-format	user.exe, 00000002.00000002.3408755287.000001F847852000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.dhimyotis.com/certignarootca.crlI	user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	user.exe, 00000002.00000002.3409026139.000001F847990000.00000004.00001000.00020000.00000000.sdmp	false	high
http://cacerts.digi	user.exe, 00000000.00000003.2146517231.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2147833873.000001E955DF1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.2133414750.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp	false	high
http://repository.swisssign.com/L	user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crl.xrampsecurity.com/XGCA.crlR	user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	false	high
https://peps.python.org/pep-0205/	user.exe, 00000002.00000002.3408948014.000001F847890000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F84770C000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2152930488.000001F845809000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	false	high
http://crl.dhimyotis.com/certignarootca.crl	user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp	false	high
http://curl.haxx.se/rfc/cookie_spec.html	user.exe, 00000002.00000002.3409847357.000001F8481A0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.2160160747.000001F847D8F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ocsp.accv.es	user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	user.exe, 00000002.00000002.3409767823.000001F8480A0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	user.exe, 00000002.00000002.3408336405.000001F847124000.00000004.00001000.00020000.00000000.sdmp	false	high
https://httpbin.org/get	user.exe, 00000002.00000002.3409928858.000001F8482A0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.2160667306.000001F848405000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://wwww.certigna.fr/autorites/0m	user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/issues/86361.	user.exe, 00000002.00000003.2157638573.000001F8477A6000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157728627.000001F8477B8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157877021.000001F847795000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F847768000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157782225.000001F847769000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157689910.000001F847768000.00000004.00000020.00020000.00000000.sdmp	false	high
https://httpbin.org/	user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.apache.org/licenses/	user.exe, 00000000.00000003.2135434533.000001E955DE4000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	false	high
https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main	user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	high
https://wwww.certigna.fr/autorites/	user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	_rust.pyd.0.dr	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp	false	high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8477E5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cryptography.io/en/latest/installation/	user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata	user.exe, 00000002.00000002.3409687341.000001F847F90000.00000004.00001000.00020000.00000000.sdmp	false	high
http://crl.securetrust.com/STCA.crl	user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	false	high
http://wwwsearch.sf.net/):	user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/python/importlib_metadata/wiki/Development-Methodology	user.exe, 00000002.00000002.3409767823.000001F8480A0000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.accv.es/legislacion_c.htm	user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	false	high
http://tools.ietf.org/html/rfc6125#section-6.4.3	user.exe, 00000002.00000002.3409767823.000001F8480A0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://cryptography.io/en/latest/security/	user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	high
https://cffi.readthedocs.io/en/latest/using.html#callbacks	_cffi_backend.cp313-win_amd64.pyd.0.dr	false	high
http://crl.xrampsecurity.com/XGCA.crl0	user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.cert.fnmt.es/dpcs/	user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp	false	high
https://google.com/mail	user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp	false	high
https://packaging.python.org/specifications/entry-points/	user.exe, 00000002.00000002.3409687341.000001F847F90000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.accv.es00	user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.python.org/psf/license/)	user.exe, 00000002.00000002.3412055684.00007FFD94678000.00000002.00000001.01000000.00000004.sdmp	false	high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/pyca/cryptography/issues	METADATA.0.dr, _rust.pyd.0.dr	false	high
https://readthedocs.org/projects/cryptography/badge/?version=latest	user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	user.exe, 00000002.00000002.3409026139.000001F847990000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	user.exe, 00000002.00000002.3408755287.000001F847690000.00000004.00000020.00020000.00000000.sdmp	false	high
http://google.com/	user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ocsp.accv.est	user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://mahler:8092/site-updates.py	user.exe, 00000002.00000002.3409186030.000001F847D58000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2160160747.000001F847D8F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.securetrust.com/SGCA.crl	user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	false	high
http://.../back.jpeg	user.exe, 00000002.00000002.3409928858.000001F8482A0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://tools.ietf.org/html/rfc7231#section-4.3.6)	user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F8477A6000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/pyca/cryptography	user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	high
https://cryptography.io/	METADATA.0.dr	false	high
https://httpbin.org/post	user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157425379.000001F847765000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F847768000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157782225.000001F847769000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157689910.000001F847768000.00000004.00000020.00020000.00000000.sdmp	false	high
https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error	user.exe, 00000002.00000002.3410228590.000001F848C44000.00000004.00001000.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	user.exe, 00000002.00000002.3408336405.000001F847124000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/pyca/cryptography/	user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	high
https://github.com/Ousret/charset_normalizer	user.exe, 00000002.00000003.2160391877.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.firmaprofesional.com/cps0	user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	user.exe, 00000002.00000002.3408336405.000001F8470A0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/urllib3/urllib3/issues/2920	user.exe, 00000002.00000002.3409767823.000001F8480A0000.00000004.00001000.00020000.00000000.sdmp	false	high
http://crl.securetrust.com/SGCA.crl0	user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	user.exe, 00000002.00000002.3408174927.000001F8457B7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://yahoo.com/	user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847C78000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.securetrust.com/STCA.crl0	user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://html.spec.whatwg.org/multipage/	user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.quovadisglobal.com/cps0	user.exe, 00000002.00000002.3409186030.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	user.exe, 00000002.00000002.3409186030.000001F847D58000.00000004.00000020.00020000.00000000.sdmp	false	high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	user.exe, 00000002.00000002.3409105783.000001F847A90000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cryptography.io/en/latest/changelog/	user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	high
https://www.rfc-editor.org/rfc/rfc8259#section-8.1	user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8477E5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/pyca/cryptography/issues/9253	_rust.pyd.0.dr	false	high
https://mail.python.org/mailman/listinfo/cryptography-dev	user.exe, 00000000.00000003.2134952192.000001E955DE7000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	high
https://requests.readthedocs.io	user.exe, 00000002.00000002.3409928858.000001F8482A0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157425379.000001F847765000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F847768000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157782225.000001F847769000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157689910.000001F847768000.00000004.00000020.00020000.00000000.sdmp	false	high
http://repository.swisssign.com/	user.exe, 00000002.00000002.3409186030.000001F847D58000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3409186030.000001F847CB9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.xrampsecurity.com/XGCA.crl	user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.python.org	user.exe, 00000002.00000002.3408755287.000001F8476FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157425379.000001F847765000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2158515942.000001F847768000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157782225.000001F847769000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2157689910.000001F847768000.00000004.00000020.00020000.00000000.sdmp	false	high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	user.exe, 00000002.00000002.3409186030.000001F847BF5000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.dhimyotis.com/certignarootca.crlh	user.exe, 00000002.00000002.3410010250.000001F848405000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.accv.es/legislacion_c.htm0U	user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ocsp.accv.es0	user.exe, 00000002.00000002.3409186030.000001F847F25000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.python.org/	user.exe, 00000002.00000002.3409186030.000001F847D58000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.2160160747.000001F847D8F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://json.org	user.exe, 00000002.00000002.3408589562.000001F847350000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579342
Start date and time:	2024-12-21 19:51:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	user.exe
Detection:	MAL
Classification:	mal60.troj.evad.winEXE@3/41@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.12.23.50
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.

Simulations

Behavior and APIs

Time	Type	Description
19:52:07	Task Scheduler	Run new task: WindowsUpdateService path: C:\Users\user\user.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse
	8v1GZ8v1LF.exe	Get hash	malicious	Unknown	Browse
	HX Design.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse
	c9toH15OT0.exe	Get hash	malicious	Unknown	Browse
	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse
	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.telegram.org	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	149.154.167.220
	8v1GZ8v1LF.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	HX Design.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	149.154.167.220
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	c9toH15OT0.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.99
	8v1GZ8v1LF.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.99
	HX Design.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse	149.154.167.220

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\mfc140u.dll	DeltaX.exe	Get hash	malicious	Unknown	Browse
	zapret.exe	Get hash	malicious	Unknown	Browse
	winws1.exe	Get hash	malicious	Unknown	Browse
	zapret.exe	Get hash	malicious	Unknown	Browse
	zapret.exe	Get hash	malicious	Unknown	Browse
	discord.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	zapret.exe	Get hash	malicious	Unknown	Browse
	Payload.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	Payload.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\win32ui.pyd	List Furniture.bat	Get hash	malicious	Python Stealer, Braodo	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\mfc140u.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5653536
Entropy (8bit):	6.729079283804055
Encrypted:	false
SSDEEP:	49152:ULnsrdZXUTQyJa9qgUUjlQNXkW8GCBTDgHsYogTYn3s3pQMqSj+vTCfEs7ATWYls:UoJUEUYS3zUQFLOAkGkzdnEVomFHKnP+
MD5:	CD1D99DF975EE5395174DF834E82B256
SHA1:	F395ADA2EFC6433B34D5FBC5948CB47C7073FA43
SHA-256:	D8CA1DEA862085F0204680230D29BFF4D168FFF675AB4700EEAF63704D995CB3
SHA-512:	397F725E79CA2C68799CF68DFB111A1570427F3D2175D740758C387BDAA508BC9014613E997B92FC96E884F66BB17F453F8AA035731AFD022D9A4E7095616F87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: DeltaX.exe, Detection: malicious, Browse Filename: zapret.exe, Detection: malicious, Browse Filename: winws1.exe, Detection: malicious, Browse Filename: zapret.exe, Detection: malicious, Browse Filename: zapret.exe, Detection: malicious, Browse Filename: discord.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: zapret.exe, Detection: malicious, Browse Filename: Payload.exe, Detection: malicious, Browse Filename: Payload.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d...9.:e.........." .....(-..X)......X,.......................................V.....&~V...`A..........................................:.....h.;.......?......`=..8....V. (...PU.0p..P.5.T...........................`...8............@-.P...(.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\win32ui.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1044992
Entropy (8bit):	6.005174713821525
Encrypted:	false
SSDEEP:	12288:cVDH7h88c4vGmhhbrGRUDG+AYZ2OWTw/3EnrE:sDHdRcgFv8qWTwco
MD5:	9AF5F53A9201B7E62AC91EDC8AB89C6A
SHA1:	4DDFE7AF2248A76B5DB90AF0EAF4C80E2B4CD6DB
SHA-256:	F84528FC136D8ABAE77543B8E9E8C9489C4495C491807907E675C15F028816F6
SHA-512:	0581BA9951452BD7B2A193B8D73573B49CB8115468B6AF8B988628670A768A6882AC4C2C9FAA559F731ADD4378DCF606C3FFEEF96AD8A479B272E6C429DC1293
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: List Furniture.bat, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;`K.Z...Z...Z..."...Z..=/...Z.......Z..."...Z.../...Z.../...Z.../...Z...Z...\.../...Z..=/...Z..=/...Z..=/...Z..=/...Z..Rich.Z..........................PE..d...~..g.........." .....\|...r......T1....................................................`.............................................T......h............p..............0..`\......T.......................(.......8................0...........................text....z.......\|.................. ..`.rdata.............................@..@.data........P.......6..............@....pdata......p......................@..@.rsrc................z..............@..@.reloc..`\...0...^..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.701724666218339
Encrypted:	false
SSDEEP:	768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
MD5:	68156F41AE9A04D89BB6625A5CD222D4
SHA1:	3BE29D5C53808186EBA3A024BE377EE6F267C983
SHA-256:	82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
SHA-512:	F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......\|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84240
Entropy (8bit):	6.607563436050078
Encrypted:	false
SSDEEP:	1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
MD5:	CB8C06C8FA9E61E4AC5F22EEBF7F1D00
SHA1:	D8E0DFC8127749947B09F17C8848166BAC659F0D
SHA-256:	FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
SHA-512:	E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\_cffi_backend.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179200
Entropy (8bit):	6.189919896183334
Encrypted:	false
SSDEEP:	3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
MD5:	5CBA92E7C00D09A55F5CBADC8D16CD26
SHA1:	0300C6B62CD9DB98562FDD3DE32096AB194DA4C8
SHA-256:	0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
SHA-512:	7AB432C8774A10F04DDD061B57D07EBA96481B5BB8C663C6ADE500D224C6061BC15D17C74DA20A7C3CEC8BBF6453404D553EBAB22D37D67F9B163D7A15CF1DED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i..#-p.p-p.p-p.p$..p!p.p=.q/p.p=.zp)p.p=.q)p.p=.q%p.p=.q!p.pf..q)p.p9.q.p.p-p.p.p.pe..q)p.p$..p,p.pe..q,p.pe.xp,p.pe..q,p.pRich-p.p........................PE..d..._..f.........." ...).....B......@........................................0............`..........................................h..l....i..................T............ ......0O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...n..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131344
Entropy (8bit):	6.311142284249784
Encrypted:	false
SSDEEP:	3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
MD5:	A55E57D7594303C89B5F7A1D1D6F2B67
SHA1:	904A9304A07716497CF3E4EAAFD82715874C94F1
SHA-256:	F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
SHA-512:	FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	277776
Entropy (8bit):	6.5855511991551
Encrypted:	false
SSDEEP:	6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
MD5:	F3377F3DE29579140E2BBAEEFD334D4F
SHA1:	B3076C564DBDFD4CA1B7CC76F36448B0088E2341
SHA-256:	B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
SHA-512:	34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	6.220967684620152
Encrypted:	false
SSDEEP:	768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
MD5:	32D76C9ABD65A5D2671AEEDE189BC290
SHA1:	0D4440C9652B92B40BB92C20F3474F14E34F8D62
SHA-256:	838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
SHA-512:	49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157968
Entropy (8bit):	6.854644275249963
Encrypted:	false
SSDEEP:	3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
MD5:	1BA022D42024A655CF289544AE461FB8
SHA1:	9772A31083223ECF66751FF3851D2E3303A0764C
SHA-256:	D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
SHA-512:	2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....\|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33552
Entropy (8bit):	6.446391764486538
Encrypted:	false
SSDEEP:	384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
MD5:	1C03CAA59B5E4A7FB9B998D8C1DA165A
SHA1:	8A318F80A705C64076E22913C2206D9247D30CD7
SHA-256:	B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
SHA-512:	783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83728
Entropy (8bit):	6.331814573029388
Encrypted:	false
SSDEEP:	1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
MD5:	FE896371430BD9551717EF12A3E7E818
SHA1:	E2A7716E9CE840E53E8FC79D50A77F40B353C954
SHA-256:	35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
SHA-512:	67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181520
Entropy (8bit):	5.972827303352998
Encrypted:	false
SSDEEP:	3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
MD5:	1C0E3E447F719FBE2601D0683EA566FC
SHA1:	5321AB73B36675B238AB3F798C278195223CD7B1
SHA-256:	63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
SHA-512:	E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38160
Entropy (8bit):	6.338856805460127
Encrypted:	false
SSDEEP:	768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
MD5:	1C30CC7DF3BD168D883E93C593890B43
SHA1:	31465425F349DAE4EDAC9D0FEABC23CE83400807
SHA-256:	6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
SHA-512:	267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI24482\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.818583535960129
Encrypted:	false
SSDEEP:	96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
MD5:	56FE4F6C7E88212161F49E823CCC989A
SHA1:	16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
SHA-256:	002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
SHA-512:	7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	5.953784637413928
Encrypted:	false
SSDEEP:	3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
MD5:	10116447F9276F10664BA85A5614BA3A
SHA1:	EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
SHA-256:	C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
SHA-512:	C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	5.074230645519915
Encrypted:	false
SSDEEP:	96:DloQIUQIhQIKQILbQIRIaMPktjaVxsxA2TLLDmplH7dwnqTIvrUmA0JQTQCQx5KN:RcPuP1srTLLDmplH7JTIvYX0JQTQ9x54
MD5:	C891CD93024AF027647E6DE89D0FFCE2
SHA1:	01D8D6F93F1B922A91C82D4711BCEFB885AD47B0
SHA-256:	EB36E0E4251E8479EF36964440755EF22BEDD411BA87A93F726FA8E5BB0E64B0
SHA-512:	3386FBB3DCF7383B2D427093624C531C50BE34E3E0AA0984547B953E04776D0D431D5267827F4194A9B0AD1AB897869115623E802A6A1C5D2AE1AD82C96CCE71
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 43.0.3.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15485
Entropy (8bit):	5.562603127346912
Encrypted:	false
SSDEEP:	192:1XxTB7oz5jF4EHRThXsI4WPm6LciTwqU+NX6in5hqw/t+B:1XX7ohCE3sIPm6LciTwqU+96inhgB
MD5:	196EB487FE23136C14B43FE28FD62DAD
SHA1:	B7878EA852FA6C6A9B173E60B81029B5B00BA691
SHA-256:	4032FF71C85740D209A454E06F96CBC56302ACEC18E1BD539D39369292DB2110
SHA-512:	F2052E1F42C8EC69DCF501FFA32B27AEC939E769786BEE1F95C24466C774987F5AA8C13B5996D6C59D04755442EB421E53E0AE5EE0148872F9BD9FE01CF3FC8E
Malicious:	false
Preview:	cryptography-43.0.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.3.dist-info/METADATA,sha256=6zbg5CUehHnvNpZEQHVe8ivt1BG6h6k_cm-o5bsOZLA,5440..cryptography-43.0.3.dist-info/RECORD,,..cryptography-43.0.3.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.3.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.3.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.3.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=-FkHKD9mSuEfH37wsSKnQzJZmL5zUAUTpB5OeUQjPE0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-313.pyc,,..cryptography/__pycache__/__init__.cpython-313.pyc,,..cryptography/__pycache__/exceptions.cpython-313.pyc,,..cryptography/__p

C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.016084900984752
Encrypted:	false
SSDEEP:	3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
MD5:	C869D30012A100ADEB75860F3810C8C9
SHA1:	42FD5CFA75566E8A9525E087A2018E8666ED22CB
SHA-256:	F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
SHA-512:	B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info\license_files\LICENSE

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info\license_files\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info\license_files\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7834624
Entropy (8bit):	6.517862303223651
Encrypted:	false
SSDEEP:	49152:oFNZj7fIo9W67PapgzJTkrXyzNzpXAbuiqCgIns3mYEXEqMrIU6i7GtlqdVwASO/:QI9X/gIFYEXME+oFNr5VQCJheq4BsxH
MD5:	BFD28B03A4C32A9BCB001451FD002F67
SHA1:	DD528FD5F4775E16B2E743D3188B66F1174807B2
SHA-256:	8EF0F404A8BFF12FD6621D8F4F209499613F565777FE1C2A680E8A18F312D5A7
SHA-512:	6DC39638435F147B399826E34F78571D7ED2ED1232275E213A2B020224C0645E379F74A0CA5DE86930D3348981C8BB03BBBECFA601F8BA781417E7114662DDEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.b.6...6...6...?..$...&9..4...&9..2...&9..>...&9..'...}...8...Y<..5...6...2...~8..I...6.......~8..7...~8..7...Rich6...........PE..d......g.........." ...)..Y..$........W.......................................w...........`..........................................q.....l.q.............. s...............w......zi.T....................{i.(...Pyi.@.............Y..............................text...k.Y.......Y................. ..`.rdata...A....Y..B....Y.............@..@.data...@+....q.......q.............@....pdata....... s.......r.............@..@.reloc........w.......v.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\python3.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70416
Entropy (8bit):	6.1258200129869405
Encrypted:	false
SSDEEP:	768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
MD5:	16855EBEF31C5B1EBE767F1C617645B3
SHA1:	315521F3A748ABFA35CD4D48E8DD09D0556D989B
SHA-256:	A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
SHA-512:	C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\python313.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6083856
Entropy (8bit):	6.126922729922386
Encrypted:	false
SSDEEP:	49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
MD5:	B9DE917B925DD246B709BB4233777EFD
SHA1:	775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
SHA-256:	0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
SHA-512:	F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32\pythoncom313.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	678400
Entropy (8bit):	6.050905552138285
Encrypted:	false
SSDEEP:	6144:r0G3L613PCcuXLq0Qroh0abOY6RWd0GrNmFKlOKdSAjUpdc6YcAQE7KytwhrPYL+:AGm16c0QroXbWnGVlOKQpdAUmN+
MD5:	070B0C071A05B06223B927F1711E0B9C
SHA1:	C482B1E1C1CDA3E0AEB84A0C3EF315C355BA003B
SHA-256:	9D1097ABAD812B53A68C2BFCF9EFEF7559E39873950A000FAC9A7C7C5B199292
SHA-512:	D05389A078C66426EA9CA3A8DF1721ABE246F59A3684DCFA9C5B031A93D96506A0D3BB8795330CFC0E81B23BBF7D91BBDE51EFFD152A234BA5ED63673F41086B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........~..-..-..-...-...-..,..-..,..-..,..-..,..-..,..-..,..-...,..-..,..-..-...-..,...-..,..-..,..-Rich..-................PE..d......g.........." ................4........................................ ............`..........................................u...c..............l....`...{............... ..`1..T............................1..8............................................text...#........................... ..`.rdata...$.......&..................@..@.data....L..........................@....pdata...{...`...\|..................@..@.rsrc...l............4..............@..@.reloc... ......."...8..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\pywin32_system32\pywintypes313.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135680
Entropy (8bit):	6.0205382324631955
Encrypted:	false
SSDEEP:	3072:q9GPDeI1KuOQEbULZYY/r06YrqHXmZEdb/XAnLT:GgDJ1vOlbfY/rke3mZE9/XA
MD5:	2A87D04E9E7CBFF67E8EA4F6315C0EBB
SHA1:	CF5B2BB53B37087ECA18E509B8551ED5CB7575D9
SHA-256:	D011068781CFBA0955258505DBE7E5C7D3D0B955E7F7640D2F1019D425278087
SHA-512:	2138E051AC116D3ABE11101C75F8BD8388D7FBA89B15E6F82DC35FD78BDD913ED8BA468769F68440CE7834825806281AA15F0023855E3B8248266414D60A4A44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.J+.z$x.z$x.z$x...x.z$xW.%y.z$xc..x.z$xW.!y.z$xW. y.z$xW.'y.z$xN. y.z$xM.%y.z$xN.%y.z$x.z%x.z$x..-y.z$x..$y.z$x..&y.z$xRich.z$x................PE..d...X..g.........." .........................................................`............`.........................................0...lB......,....@..l.... ...............P..0....a..T............................b..8...............p............................text...9........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata....... ......................@..@.rsrc...l....@......................@..@.reloc..0....P......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\select.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30992
Entropy (8bit):	6.554484610649281
Encrypted:	false
SSDEEP:	384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
MD5:	20831703486869B470006941B4D996F2
SHA1:	28851DFD43706542CD3EF1B88B5E2749562DFEE0
SHA-256:	78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
SHA-512:	4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	709904
Entropy (8bit):	5.861739047785334
Encrypted:	false
SSDEEP:	12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
MD5:	0902D299A2A487A7B0C2D75862B13640
SHA1:	04BCBD5A11861A03A0D323A8050A677C3A88BE13
SHA-256:	2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
SHA-512:	8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\win32\_win32sysloader.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.116146861242879
Encrypted:	false
SSDEEP:	192:ketklgde+ljBEs0I62SbPbVlQmUAaPHTPMRX7aMHvcqvn7yab6x/:/d1tT0h2SbAmFaPHTmphvH6x/
MD5:	5521E251A515964D04BC90CE8A2AA24C
SHA1:	F7B4AB985DC9A1C7EF2F716999D276D126515BEC
SHA-256:	F382CFFA30F533484FA6314E90A1408F0826867D70B3320220FD86AAFAC37526
SHA-512:	FFEB0185B6D74881B3DCA25BA1B11C33CBCF3B466F3F1B888D662611925399BA2C7D8F133673474F691C068E67811A3FAD0FC057036A5B156B735019FAA882B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%g.ND..ND..ND..G<..LD...1..LD...<..LD...1..ED...1..FD...1..MD......MD..ND..dD..1..OD..1..OD..1..OD..RichND..................PE..d...\|..g.........." ......................................................................`..........................................;..`...p;..d....p..t....`..................@...\|2..T............................2..8............0..p............................text............................... ..`.rdata..4....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\win32\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	5.868928551727267
Encrypted:	false
SSDEEP:	3072:mQKZG4IWJW8E60/c0nlRVFhLaNzvX2/qQvmYbtrprA3e:ZKZG7WgdnlRVgvm/qQDtrprA
MD5:	C5067F04B506B09E48D4D07470E5A182
SHA1:	20435C1A092141CE67E943C95E5CF522762ACD91
SHA-256:	E19294BC2C145A9D87D4A2D8412830C8FF4C8C1B9AD005BD68ABD4B566AF1887
SHA-512:	56F08A5EB927921DED50E92EA972253E68C1216DAA48871B3AA9ED62DB5712E665DFDA406C73E9F33736B61ED1F0CD016E6B4FFEE0237781FB98EEB63672F81E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V............................................+.............................................Rich............PE..d......g.........." .........................................................P............`......................................... ................0..\.......X............@..X...xv..T............................;..8............0..........@....................text............................... ..`.rdata......0......................@..@.data...X(......."..................@....pdata..X...........................@..@.rsrc...\....0......................@..@.reloc..X....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI24482\win32\win32trace.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.260538552870905
Encrypted:	false
SSDEEP:	384:k1CAOcv3ugutnS5nW8sHt+9Nie20T8DmDxPBQ/vMj75yn9OJg1Bl:kh/pWKJPy/0PUOJuB
MD5:	75C14B382EEF49322BB28F79DD2A7A54
SHA1:	13CCCA1F8B19D68331E7FE981113B042FAC34408
SHA-256:	5049C9956310FFC80C1C21C2D8A6562BA810E4592DB7DAD92462D238D82F65C0
SHA-512:	3182316DEF1F09FF45C87BF6A099EF4C4D0AFA0CFF073C54AB59159E79E096ADCA0C4912B1851DE42E5EE0FC5B6C4163FCCB833A4CCE8F2AA42079D0C11D0D7A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(U.F..F..F.......F...G...F...C...F...B...F...E..F.8.G...F...G...F...G...F..G...F.8.O..F.8.F..F.8.D..F.Rich.F.................PE..d...w..g.........." .....,...........(....................................................`..........................................Q..T....Q..........d....p..,....................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata..,....p.......R..............@..@.rsrc...d............X..............@..@.reloc...............\..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gen_py\3.13\init.py

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.713840781302666
Encrypted:	false
SSDEEP:	3:S3yE25MOWrYXtHVE/DRFrgm5/gvJgXDLAUDA+ERo6+aEYqVS1f6gq1WGgVSBn:S3mSOWWHVUDjrgmxgRgzLXDA6Va8VeuR
MD5:	8C7CA775CF482C6027B4A2D3DB0F6A31
SHA1:	E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
SHA-256:	52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
SHA-512:	19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
Malicious:	false
Preview:	# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..

C:\Users\user\AppData\Local\Temp\gen_py\3.13\dicts.dat

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	data
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.7219280948873625
Encrypted:	false
SSDEEP:	3:qW6:qW6
MD5:	2C7344F3031A5107275CE84AED227411
SHA1:	68ACAD72A154CBE8B2D597655FF84FD31D57C43B
SHA-256:	83CDA9FECC9C008B22C0C8E58CBCBFA577A3EF8EE9B2F983ED4A8659596D5C11
SHA-512:	F58362C70A2017875D231831AE5868DF22D0017B00098A28AACB5753432E8C4267AA7CBF6C5680FEB2DC9B7ABADE5654C3651685167CC26AA208A9EB71528BB6
Malicious:	false
Preview:	..K....}..

C:\Users\user\Desktop\errors.log

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text, with very long lines (387), with CRLF line terminators
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.486745695480586
Encrypted:	false
SSDEEP:	12:lpIMN0CNrrhv0m/VQHj9LgYMd7mtY9tPc+Kxm:lpIQXhb2dG7/kU
MD5:	A1D1AF0C58C3461E95AF95DA57B225E4
SHA1:	8BF29D2BEC505127595A9EB924316A6539EF441A
SHA-256:	2BBBBCACBEA590690CF54BD30787EE4182D3182A34A7518946BB52AA72E92571
SHA-512:	383405F46BCBEEA4BF138FE6F09F38C69E864EE69834C8E82CC16157CD7F17F82F153055C7EFD44D1F6C02F6959171349FA241F495588FB88FB9177DB203BA54
Malicious:	false
Preview:	2024-12-21 15:07:06,134 - ERROR - Error sending Telegram message: HTTPSConnectionPool(host='api.telegram.org', port=443): Max retries exceeded with url: /bot8198088572:AAHwnTyia_2pAX94h0pkYLAjGks3YjPwP0M/sendMessage (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1020)')))..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.99424709182811
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	user.exe
File size:	15'746'174 bytes
MD5:	9ac651562b490c1651fdd79149040bf8
SHA1:	fc17e22b0f17755ee5a665c0dc4d128e4eb6d8c2
SHA256:	c414aac5e5b64da60d998f5d82d3233204ddbe02981b8734fca6dd0b56f691cf
SHA512:	04cbffc4d9291e6eb5a22ec5c9b784075834a8de35db0bac7b7f467d6a4afd509ac2e926c5714bd7431253d8d85ce1da6a3fe40ca3ca684416ac763a64a5bc85
SSDEEP:	393216:dVlj87d5ta63hucsXMCHWUjvcuIF//PYPXCa:dVl8ZXr3hrsXMb8k1//w6a
TLSH:	CAF6331756D81F9ED7A381B488A0934EE419BF9F06A3D56BD2A47A023D631C04CBFD72
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..\.Z\.Z\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z\.Z.\.Zb..[3\.Zb..[+\.ZRich*\.Z........PE..d..

File Icon


Icon Hash:	0f33a9cdcdc96317

Static PE Info

General

Entrypoint:	0x14000cdb0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6766C772 [Sat Dec 21 13:49:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F4534BBFE2Ch
dec eax
add esp, 28h
jmp 00007F4534BBFA4Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F4534BC01F8h
test eax, eax
je 00007F4534BBFBF3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F4534BBFBD7h
dec eax
cmp ecx, eax
je 00007F4534BBFBE6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003577Ch], ecx
jne 00007F4534BBFBC0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F4534BBFBC9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F4534BBFBD9h
mov byte ptr [00035765h], 00000001h
call 00007F4534BBF325h
call 00007F4534BC0610h
test al, al
jne 00007F4534BBFBD6h
xor al, al
jmp 00007F4534BBFBE6h
call 00007F4534BCD12Fh
test al, al
jne 00007F4534BBFBDBh
xor ecx, ecx
call 00007F4534BC0620h
jmp 00007F4534BBFBBCh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003572Ch], 00000000h
mov ebx, ecx
jne 00007F4534BBFC39h
cmp ecx, 01h
jnbe 00007F4534BBFC3Ch
call 00007F4534BC016Eh
test eax, eax
je 00007F4534BBFBFAh
test ebx, ebx
jne 00007F4534BBFBF6h
dec eax
lea ecx, dword ptr [00035716h]
call 00007F4534BCCF22h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca5c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x10e34	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2250	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x58000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f00	0x2a000	2a7ae207b6295492e9da088072661752	False	0.5514439174107143	data	6.487454925709845	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a50	0x12c00	1c532532da1a8d04f97d47e2e1d78425	False	0.524453125	data	5.7526106245790665	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2250	0x2400	f5559f14427a02f0a5dbd0dd026cae54	False	0.470703125	data	5.291665041994019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x10e34	0x11000	e963a5ba5d34917c3f18755597b3b01e	False	0.13597196691176472	data	4.022502943941432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x58000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x470e8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/m	0.12723293505264402
RT_GROUP_ICON	0x57910	0x14	data	1.15
RT_MANIFEST	0x57924	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 19:52:07.336180925 CET	49709	443	192.168.2.6	149.154.167.220
Dec 21, 2024 19:52:07.336194038 CET	443	49709	149.154.167.220	192.168.2.6
Dec 21, 2024 19:52:07.336272001 CET	49709	443	192.168.2.6	149.154.167.220
Dec 21, 2024 19:52:07.337219954 CET	49709	443	192.168.2.6	149.154.167.220
Dec 21, 2024 19:52:07.337233067 CET	443	49709	149.154.167.220	192.168.2.6
Dec 21, 2024 19:52:08.733117104 CET	443	49709	149.154.167.220	192.168.2.6
Dec 21, 2024 19:52:08.734096050 CET	49709	443	192.168.2.6	149.154.167.220
Dec 21, 2024 19:52:08.734110117 CET	443	49709	149.154.167.220	192.168.2.6
Dec 21, 2024 19:52:08.735996008 CET	443	49709	149.154.167.220	192.168.2.6
Dec 21, 2024 19:52:08.736124992 CET	49709	443	192.168.2.6	149.154.167.220
Dec 21, 2024 19:52:08.737837076 CET	49709	443	192.168.2.6	149.154.167.220
Dec 21, 2024 19:52:08.738003969 CET	49709	443	192.168.2.6	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 19:52:07.187279940 CET	54612	53	192.168.2.6	1.1.1.1
Dec 21, 2024 19:52:07.327248096 CET	53	54612	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 21, 2024 19:52:07.187279940 CET	192.168.2.6	1.1.1.1	0x34a5	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 21, 2024 19:52:07.327248096 CET	1.1.1.1	192.168.2.6	0x34a5	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:51:59
Start date:	21/12/2024
Path:	C:\Users\user\Desktop\user.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\user.exe"
Imagebase:	0x7ff715750000
File size:	15'746'174 bytes
MD5 hash:	9AC651562B490C1651FDD79149040BF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:52:02
Start date:	21/12/2024
Path:	C:\Users\user\Desktop\user.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\user.exe"
Imagebase:	0x7ff715750000
File size:	15'746'174 bytes
MD5 hash:	9AC651562B490C1651FDD79149040BF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF7157589E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF715759390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7157545F4,00000000,00007FF715751985), ref: 00007FF7157593C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758A56

Part of subcall function 00007FF71576A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71576A490

Part of subcall function 00007FF71576871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF715768783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758AE6
CreateProcessW.KERNELBASE ref: 00007FF715758B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758B28

Part of subcall function 00007FF715752C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF715753706,?,00007FF715753804), ref: 00007FF715752C9E
Part of subcall function 00007FF715752C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF715753706,?,00007FF715753804), ref: 00007FF715752D63
Part of subcall function 00007FF715752C50: MessageBoxW.USER32 ref: 00007FF715752D99

RegisterClassW.USER32 ref: 00007FF715758B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758B8B
CreateWindowExW.USER32 ref: 00007FF715758BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758C15
PeekMessageW.USER32 ref: 00007FF715758C39
TranslateMessage.USER32 ref: 00007FF715758C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758C51
PeekMessageW.USER32 ref: 00007FF715758C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758E04
GetExitCodeProcess.KERNEL32 ref: 00007FF715758E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF715753F7F), ref: 00007FF715758E2F

Strings

PyInstallerOnefileHiddenWindow, xrefs: 00007FF715758B54
CreateProcessW, xrefs: 00007FF715758B37
PyInstaller Onefile Hidden Window, xrefs: 00007FF715758B95
Failed to create child process!, xrefs: 00007FF715758B30

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: eeab82a36a81ca113f3fecc1650c22d8c59d77ea189230f22ac0e4dc7cf71023
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 30D16231A18E8286EB14AF34E85A2B9B774FB48F68F900235DA5D42AB4DF3CD54DC710

Function 00007FF715751000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MEI, xrefs: 00007FF715753933
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF715753BE8
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7157539DE
pyi-python-flag, xrefs: 00007FF715753AD6
Failed to load splash screen resources!, xrefs: 00007FF715753E85
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF715753C61
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF715753D12
Py_GIL_DISABLED, xrefs: 00007FF715753AF4
pyi-disable-windowed-traceback, xrefs: 00007FF715753BB2
Failed to start splash screen!, xrefs: 00007FF715753ED4
_PYI_ARCHIVE_FILE, xrefs: 00007FF7157538D2, 00007FF7157539FF
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF715753882, 00007FF7157538AF
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF715753EA6
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF715753A0B, 00007FF715753CD4, 00007FF715753F6B
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF715753B32
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF715753D35
_PYI_SPLASH_IPC, xrefs: 00007FF715753A23, 00007FF715753EF5
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF715753EBB
Failed to convert DLL search path!, xrefs: 00007FF715753DDC
Failed to remove temporary directory: %s, xrefs: 00007FF715753FCF
pyi-runtime-tmpdir, xrefs: 00007FF715753B68
Could not create temporary directory!, xrefs: 00007FF715753CBF
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF715753A17, 00007FF715753A2F, 00007FF715753A9B
pkg, xrefs: 00007FF7157539BE
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF715753E0A
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF715753971
pyi-contents-directory, xrefs: 00007FF715753B8D
VCRUNTIME140.dll, xrefs: 00007FF715753DB1

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: f34adffd595ae6d0ab4ff6508a6aaa05fd206487cbf925b5956127d2412d9179
Instruction ID: 58dd2ba80dbce8395e45d855a4c0d074b63ba3ff94bdad1ae7dd072854ad1923
Opcode Fuzzy Hash: f34adffd595ae6d0ab4ff6508a6aaa05fd206487cbf925b5956127d2412d9179
Instruction Fuzzy Hash: 91328161A28E8251FA1DBB24D45A2B9A771AF4CF60FC44436DA5D432F6EF2CE55CC320

Function 00007FF715775C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF715775C45

Part of subcall function 00007FF715775598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7157755AC

Part of subcall function 00007FF71576A948: RtlFreeHeap.NTDLL(?,?,?,00007FF715772D22,?,?,?,00007FF715772D5F,?,?,00000000,00007FF715773225,?,?,?,00007FF715773157), ref: 00007FF71576A95E
Part of subcall function 00007FF71576A948: GetLastError.KERNEL32(?,?,?,00007FF715772D22,?,?,?,00007FF715772D5F,?,?,00000000,00007FF715773225,?,?,?,00007FF715773157), ref: 00007FF71576A968

Part of subcall function 00007FF71576A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF71576A8DF,?,?,?,?,?,00007FF71576A7CA), ref: 00007FF71576A909
Part of subcall function 00007FF71576A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF71576A8DF,?,?,?,?,?,00007FF71576A7CA), ref: 00007FF71576A92E

_get_daylight.LIBCMT ref: 00007FF715775C34

Part of subcall function 00007FF7157755F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71577560C

_get_daylight.LIBCMT ref: 00007FF715775EAA
_get_daylight.LIBCMT ref: 00007FF715775EBB
_get_daylight.LIBCMT ref: 00007FF715775ECC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF71577610C), ref: 00007FF715775EF3

Strings

Eastern Summer Time, xrefs: 00007FF715775FB1
Eastern Standard Time, xrefs: 00007FF715775F99

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: 9e39518a609a6a74b2dae16810a91f1e1df50635db8635f9d124edf7f939a3c6
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: 3FD1D522A08A8246E728BF26E44A5B9E751EF4CFB4FC48135DA0D476B5DF3CE44D8760

Function 00007FF715776964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF715776698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7157766D9
Part of subcall function 00007FF715776698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF715776757
Part of subcall function 00007FF715776698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7157767A8

CreateFileW.KERNELBASE ref: 00007FF715776A6A
CreateFileW.KERNEL32 ref: 00007FF715776ABA
GetLastError.KERNEL32 ref: 00007FF715776AEA
GetFileType.KERNELBASE ref: 00007FF715776AFF
GetLastError.KERNEL32 ref: 00007FF715776B09
CloseHandle.KERNEL32 ref: 00007FF715776B3C
CloseHandle.KERNEL32 ref: 00007FF715776C9F
CreateFileW.KERNEL32 ref: 00007FF715776CD4
GetLastError.KERNEL32 ref: 00007FF715776CE3

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: 9e28f6dbed1c0a98924333fb5d748b672a487cfc5098a4c8f175e3712142711a
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 68C1D036B28E4285EB18EF69D0966AC7761F749FA8B910235DA1E573A8DF38D019C310

Function 00007FF715775E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF715775EAA

Part of subcall function 00007FF7157755F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71577560C

_get_daylight.LIBCMT ref: 00007FF715775EBB

Part of subcall function 00007FF715775598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7157755AC

_get_daylight.LIBCMT ref: 00007FF715775ECC

Part of subcall function 00007FF7157755C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7157755DC

Part of subcall function 00007FF71576A948: RtlFreeHeap.NTDLL(?,?,?,00007FF715772D22,?,?,?,00007FF715772D5F,?,?,00000000,00007FF715773225,?,?,?,00007FF715773157), ref: 00007FF71576A95E
Part of subcall function 00007FF71576A948: GetLastError.KERNEL32(?,?,?,00007FF715772D22,?,?,?,00007FF715772D5F,?,?,00000000,00007FF715773225,?,?,?,00007FF715773157), ref: 00007FF71576A968

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF71577610C), ref: 00007FF715775EF3

Strings

Eastern Summer Time, xrefs: 00007FF715775FB1
Eastern Standard Time, xrefs: 00007FF715775F99

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: 018cf8fb23cf421dc68e3e9323cfb5617719ca080a85025b53bfa7ccdc20bde5
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: 34517432A08A4286E718FF36E4875A9E761BB4CB64FC05535EA4D436B5DF3CE40D8760

Function 00007FF715759280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7157592B3
FindClose.KERNELBASE ref: 00007FF7157592C2

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 458ad79b6f898083fe1769401eae53a4fded3e0317c57a0229e07f52979f8c2b
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: AFF0CD22A28B4186F7649B50B48E776B360EB49B38F840335DA6D01AE4DF3CD04CC700

Function 00007FF7157708C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction ID: dcb6b98ee0a4d11f23261dafc57c0a46c0ba2155b2a6383adebc640642c3c1a5
Opcode Fuzzy Hash: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction Fuzzy Hash: A6028C25A1AE4340FA5EBB22A40A279A780AF49FB0FD54634DD6D563F1DF7CA40D8730

Function 00007FF715751950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF715757F90: _fread_nolock.LIBCMT ref: 00007FF71575803A

_fread_nolock.LIBCMT ref: 00007FF715751A1B

Part of subcall function 00007FF715752910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF715751B6A), ref: 00007FF71575295E

Strings

MEI, xrefs: 00007FF715751991
Could not read full TOC!, xrefs: 00007FF715751B55
Error on file., xrefs: 00007FF715751B8D
Could not allocate memory for archive structure!, xrefs: 00007FF715751A61
calloc, xrefs: 00007FF715751A68
fread, xrefs: 00007FF715751A32, 00007FF715751B5C
malloc, xrefs: 00007FF715751B22
Could not allocate buffer for TOC!, xrefs: 00007FF715751B1B
Failed to read cookie!, xrefs: 00007FF715751A2B
Failed to seek to cookie position!, xrefs: 00007FF7157519EE
fseek, xrefs: 00007FF7157519F5

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 5da9196b77292879a3d34eab4b69eed09277f5a680287c42466cc399433b52bb
Instruction ID: 1623f6d8500d97f15ce508b92b8c6abf3c46184d4ff88c40aa685badf6eebc07
Opcode Fuzzy Hash: 5da9196b77292879a3d34eab4b69eed09277f5a680287c42466cc399433b52bb
Instruction Fuzzy Hash: 5381C571A18E8686E718FB14E0462F9A3A1AF4CF64FC44531EA8D437A5DF3CE54D8760

Function 00007FF715751600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open target file!, xrefs: 00007FF71575165C
fwrite, xrefs: 00007FF7157517D1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7157516A2
fread, xrefs: 00007FF7157517E6
Failed to create symbolic link %s!, xrefs: 00007FF715751622
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7157517CA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF715751742
malloc, xrefs: 00007FF715751749
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7157516DA
fopen, xrefs: 00007FF715751663
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7157517DF
fseek, xrefs: 00007FF7157516E1

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 5d93e2d9b492ec2590e9e2ead86152251fe080dd2e5e8658fb94e6c4b93608a5
Instruction ID: c4815e1701f82c2e5c581fd669602266bbfd2deb30a213652e2398bc7d9c4579
Opcode Fuzzy Hash: 5d93e2d9b492ec2590e9e2ead86152251fe080dd2e5e8658fb94e6c4b93608a5
Instruction Fuzzy Hash: 3951A161B18E4386EA18BB21A4461B9A3A1BF48FB4FC44531EE5C077B5EF3CE54D8760

Function 00007FF715758660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF715753CBB), ref: 00007FF715758704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF715753CBB), ref: 00007FF71575870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF715753CBB), ref: 00007FF71575874C

Part of subcall function 00007FF715758830: GetEnvironmentVariableW.KERNEL32(00007FF71575388E), ref: 00007FF715758867
Part of subcall function 00007FF715758830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF715758889

Part of subcall function 00007FF715768238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF715768251

Part of subcall function 00007FF715752810: MessageBoxW.USER32 ref: 00007FF7157528EA

Strings

_MEI%d, xrefs: 00007FF715758712
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF71575877E
TMP, xrefs: 00007FF7157586C2
TMP, xrefs: 00007FF71575869C, 00007FF7157587A3
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7157586DC

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction ID: 9b4a66ec90a183054b2449ef8891ac6582a0f8466dd974ad07654c030910f55d
Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction Fuzzy Hash: 10419F11A29E4245FA18BB61E8572B993A1AF4DFA0FD40131ED0D576BADF3CE40D8360

Function 00007FF715751210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7157512BA
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF71575141E
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF715751276
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7157512EF
malloc, xrefs: 00007FF7157512C1, 00007FF7157512F6
1.3.1, xrefs: 00007FF715751249

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
Instruction ID: e2d23bdcd13ce99fa414081e68190c3ff2075da278b02426896d912f07418116
Opcode Fuzzy Hash: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
Instruction Fuzzy Hash: 6B51F422A18E4245E629BB11E4523BAA2A1BF48FA4FC44131EE8D477E5EF3CE44DC750

Function 00007FF7157536B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF715753804), ref: 00007FF7157536E1
GetLastError.KERNEL32(?,00007FF715753804), ref: 00007FF7157536EB

Part of subcall function 00007FF715752C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF715753706,?,00007FF715753804), ref: 00007FF715752C9E
Part of subcall function 00007FF715752C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF715753706,?,00007FF715753804), ref: 00007FF715752D63
Part of subcall function 00007FF715752C50: MessageBoxW.USER32 ref: 00007FF715752D99

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF715753790
Failed to resolve full path to executable %ls., xrefs: 00007FF715753739
\\?\, xrefs: 00007FF71575375A
GetModuleFileNameW, xrefs: 00007FF7157536FA
Failed to obtain executable path., xrefs: 00007FF7157536F3

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: c4d71bf10c2763e0040e843a1221c981981e04cb3a3c9c4e6e97007468ef44c9
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 4F216251F28E4245FA28BB20E8563B6A364BF4CB64FC00631E65D865F5EF2CE50CC360

Function 00007FF71576BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71576BE89

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction ID: 422602cfbf567bf6591091c9953e97bd971fa8f0e9a59770bd9e12cc26855e7e
Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction Fuzzy Hash: 09C1D43290CE8681F668BB1594462BDAB55FB8AFA0FD54231EA4D077A1CF7CE44D8720

Function 00007FF715758570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF715758590
OpenProcessToken.ADVAPI32 ref: 00007FF7157585A3
GetTokenInformation.KERNELBASE ref: 00007FF7157585C8
GetLastError.KERNEL32 ref: 00007FF7157585D2
GetTokenInformation.KERNELBASE ref: 00007FF715758612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF71575862E
CloseHandle.KERNEL32 ref: 00007FF715758646

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction ID: 435f91e9d17e49e675d123b83a001c6a7cd561419f95ecbe87b1587d7e201159
Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction Fuzzy Hash: 06216121A1CA4642EB14AB59F48523AE7B0FF89BB0F900235EA6D43AF5DF6CD44D8710

Function 00007FF7157590E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF715758570: GetCurrentProcess.KERNEL32 ref: 00007FF715758590
Part of subcall function 00007FF715758570: OpenProcessToken.ADVAPI32 ref: 00007FF7157585A3
Part of subcall function 00007FF715758570: GetTokenInformation.KERNELBASE ref: 00007FF7157585C8
Part of subcall function 00007FF715758570: GetLastError.KERNEL32 ref: 00007FF7157585D2
Part of subcall function 00007FF715758570: GetTokenInformation.KERNELBASE ref: 00007FF715758612
Part of subcall function 00007FF715758570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF71575862E
Part of subcall function 00007FF715758570: CloseHandle.KERNEL32 ref: 00007FF715758646

LocalFree.KERNEL32(?,00007FF715753C55), ref: 00007FF71575916C
LocalFree.KERNEL32(?,00007FF715753C55), ref: 00007FF715759175

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF715759142
S-1-3-4, xrefs: 00007FF715759121
D:(A;;FA;;;%s), xrefs: 00007FF715759157
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF715759183

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: ee6cc6f3ec5d1a9b91e7239f2fc63a486403ac474dbf0ffff23ccacacdd2542e
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: C0212C21A28E4241E618BB10E41A3EAA365EB8DB90FD44435EA4D53BA6DF3CD90DC760

Function 00007FF715757E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF71575352C,?,00000000,00007FF715753F23), ref: 00007FF715757F32

Strings

%s%c, xrefs: 00007FF715757EA4
%.*s, xrefs: 00007FF715757EEB
\, xrefs: 00007FF715757E97

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 9023beffec3a57a4629e8abb22503f1b718fcdb28fa34784c50d465fb9ddbb72
Instruction ID: 6a249f25a6c8c953e2ee2f898e6005a70e1982065a5fd16fc6ae13ffe9a3b316
Opcode Fuzzy Hash: 9023beffec3a57a4629e8abb22503f1b718fcdb28fa34784c50d465fb9ddbb72
Instruction Fuzzy Hash: 3831D861629EC145EA25AB11E4117AAE364EB8CFF4F900230EE6D477D5DF2CD64E8710

Function 00007FF71576CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71576CF4B), ref: 00007FF71576D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71576CF4B), ref: 00007FF71576D107

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 96d851117e1afd279c1ca7ea9ac0f5d3a7ecfb7565f5003fb4f264ed644059bc
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 85911C32F28A5145F758AF65D4422BDA7A0FB48FA8F944235DE0E136A4DF78D48EC720

Function 00007FF71576F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF71576FA7C
_get_daylight.LIBCMT ref: 00007FF71576FA8D
_get_daylight.LIBCMT ref: 00007FF71576FA9E
_isindst.LIBCMT ref: 00007FF71576FB69

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 7145026e7aaa95871cac4c08d8765eaa86a50024e57e625d221b73d112dc84e9
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 2251FB72F04A118AFB1CEF7899566BCA751AB48778FD00335DD2D52AF9DB38A40E8710

Function 00007FF71576577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF7157657AF
GetFileInformationByHandle.KERNELBASE ref: 00007FF715765811
GetLastError.KERNEL32 ref: 00007FF7157658A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7157656B4), ref: 00007FF7157658EE

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: 98493caf7e9c8fccb229ab1249dba89b5da364d9a9846cb0ca31ad773890f05c
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: F3519F22E04A428AF718EF71D4563BDA7A1AB4CF68F944634DE0D47AA8DF38D44C9720

Function 00007FF715765628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715765655
CreateFileW.KERNELBASE ref: 00007FF715765694
CloseHandle.KERNEL32 ref: 00007FF7157656C9

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction ID: 69623b875914c60f1f326beb389cf820c9365203e18643b203d5ffe72539cd15
Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction Fuzzy Hash: 5141A662D18B8183F718AF209555379A361FB98B74F909335E65C03AE1DF7CA0EC9710

Function 00007FF71575CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71575CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF71575CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF71575CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF71575CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF71575CD21

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: fdc568e14c2ef1a38ac3ee67fbe6a21bc3c743d5fea42a1d8d7e8780c5c1106f
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 47315B21E28A4745FA5CBB61D4173B993A59F49FA4FC45234EA0D472F3DF2CA90D8230

Function 00007FF71576013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715760180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF715760277

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: c5239912223b6b39e696dd360367380750b1286d9004db4d69bcb10c2ea881c5
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: B951FA61B19A4186F76EB926940667EA6A1AF48FB4F884734DD6D037E5CF3CE40C8620

Function 00007FF71576C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF71576C2CD), ref: 00007FF71576C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF71576C2CD), ref: 00007FF71576C18A

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 3de893c62bfde02b6acb00400a48806d9b7f22f453cb75ce89d62a9cdaaef48c
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 8911E262A18E8181EA28AB25F805069B361EB49FF0F940331EE7D0B7E8CF3CD01C8710

Function 00007FF715765924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF715765839), ref: 00007FF715765957
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF715765839), ref: 00007FF71576596D

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction ID: b1e4ae3c8aeb18473efbfecdc4ce696b1da22b486c8e2e85eeeae156e34fcfbe
Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction Fuzzy Hash: 5911863150CB0281E7585B15A41617AF760EB89B71FD00335FA9D819E4EF2CD05CDF20

Function 00007FF71576A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF715772D22,?,?,?,00007FF715772D5F,?,?,00000000,00007FF715773225,?,?,?,00007FF715773157), ref: 00007FF71576A95E
GetLastError.KERNEL32(?,?,?,00007FF715772D22,?,?,?,00007FF715772D5F,?,?,00000000,00007FF715773225,?,?,?,00007FF715773157), ref: 00007FF71576A968

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: ea1661c8a931b1b24a33879ab073b4fe6fd14ca73d4ad2bfec9743e1e04ebefd
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: 02E04F50E09A0282FE0D7BB2A49B1789252AF8CF20FC50130C90D422B1EF2CA88D8230

Function 00007FF71576AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF71576A9D5,?,?,00000000,00007FF71576AA8A), ref: 00007FF71576ABC6
GetLastError.KERNEL32(?,?,?,00007FF71576A9D5,?,?,00000000,00007FF71576AA8A), ref: 00007FF71576ABD0

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 82bbaa7e25dd18572a77960381fc20bfb2e913c24b3389073f86db474e5ce964
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: FD21A711B18E4285FA597766949637D92829F8CFB0F884335DA2E477F1CFACE44D4321

Function 00007FF71576BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71576BED4

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: f988c549debb264aebf57bddd41e678aa1c397bac0e4db74ca2fb379aa6f2d7b
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 1F41CB72508A4287F638AA19A552179B760EB5EF60F940731D68E436F1CF6CE40ECB61

Function 00007FF715757F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF71575803A

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 7026eb3b68f3585a2f5768ea15c5ca7bda34a28a3ae4cdbb6486ed2f903c9d01
Instruction ID: 7e2456edbcaa2c0e1db52e864ee5f3fa5b9404af8a86e3f93292b7b76213e11e
Opcode Fuzzy Hash: 7026eb3b68f3585a2f5768ea15c5ca7bda34a28a3ae4cdbb6486ed2f903c9d01
Instruction Fuzzy Hash: CB21A221B28A5246FA58BB2268063BAD661BF49FE4FD84430EE0C07796DF7DE44DC610

Function 00007FF71576B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71576B9C2

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: 5316b1cc700f6640526cbd04f24842188d81d1ae4773c52822824467b64c0e0b
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: 2B317E22A18E0285F6197B65888637CAA91AF89FB4FC50335E95D033E2CF7CE44D8735

Function 00007FF715765F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715765EF9

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: fc810e50a3de8c1f194e98b5b8a55674f8e95d62b1e9fa2e35ac3f7676258c23
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 6D118471A1CE4381FA68BF1194121BDE660BF89FA4FC84631EA4C57AA6CF7DD40C5720

Function 00007FF715776354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715776377

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 0393d2871f32812d5bd31af023325b106c7f666b914815afbad5d6f85476cc6d
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 7021C872608E4286E765AF18E445379B7A0FB88F64F944234E65D476E9DF3CD40DCB10

Function 00007FF7157603BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715760410

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 433361a63adba0e70b79e714af6a42f6ac308644b41dc0124269a5e52f7533b0
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 9A018261A08B4181F919BB529902079EAA1BF8AFF0F884771DE5C13BE6CF3CD4098310

Function 00007FF715767EFC Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715767F3A

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction ID: fa70434add02bd399a3c17e247700d837401bc95c731539cf98fdd1ce7d3e6d8
Opcode Fuzzy Hash: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction Fuzzy Hash: 34013960A1DE4380FA687B6265475B9D290AF48FF0FD44735EA1C466E6EF6CA44F4230

Function 00007FF715768238 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715768251

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: 02f3f1ece23d0658a030c99dc6ba4757e947794c978271161acd9d5415e91f6a
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: E6E08CA0E5CE038BFA1D3AA405C35B891615F9EF60FC40330E908062E3DF2C688C9232

Function 00007FF71576EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF71576B32A,?,?,?,00007FF715764F11,?,?,?,?,00007FF71576A48A), ref: 00007FF71576EBED

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: bab3ed9f81a21e9e9729160c8fc7b77d5c9899f32cfcca6728a8d1d6abc1b2c8
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: 6CF04954B09A0248FE5C76669867AB6D2819F8CFA0FCC4A30CD0F863E1EF1CA48C4230

Function 00007FF71576D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF715760C90,?,?,?,00007FF7157622FA,?,?,?,?,?,00007FF715763AE9), ref: 00007FF71576D63A

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 59abf85f6e0639e47eef4be6b46e80c05b432bebf62ecd81e7a291adecdf0d50
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 42F0DA50E29A4645FE5D7A71585B6B592905F8CFF4F884730D92E852E1EF2CA4CC8630

Non-executed Functions

Function 00007FF7157576C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7157576D7
GetLastError.KERNEL32 ref: 00007FF7157576E9
GetProcAddress.KERNEL32 ref: 00007FF715757725
GetLastError.KERNEL32 ref: 00007FF715757737
GetProcAddress.KERNEL32 ref: 00007FF715757750
GetLastError.KERNEL32 ref: 00007FF715757762
GetProcAddress.KERNEL32 ref: 00007FF71575777B
GetLastError.KERNEL32 ref: 00007FF71575778D
GetProcAddress.KERNEL32 ref: 00007FF7157577A9
GetLastError.KERNEL32 ref: 00007FF7157577BB
GetProcAddress.KERNEL32 ref: 00007FF7157577D7
GetLastError.KERNEL32 ref: 00007FF7157577E9
GetProcAddress.KERNEL32 ref: 00007FF715757805
GetLastError.KERNEL32 ref: 00007FF715757817
GetProcAddress.KERNEL32 ref: 00007FF715757833
GetLastError.KERNEL32 ref: 00007FF715757845
GetProcAddress.KERNEL32 ref: 00007FF715757861
GetLastError.KERNEL32 ref: 00007FF715757873

Strings

Tcl_DoOneEvent, xrefs: 00007FF715757771, 00007FF715757793
Tcl_FinalizeThread, xrefs: 00007FF7157577CD, 00007FF7157577EF
Tcl_EvalObjv, xrefs: 00007FF715757BEF, 00007FF715757C11
Tcl_GetString, xrefs: 00007FF715757AAD, 00007FF715757ACF
Tcl_CreateThread, xrefs: 00007FF715757829, 00007FF71575784B
Tcl_FindExecutable, xrefs: 00007FF715757746, 00007FF715757768
Tk_Init, xrefs: 00007FF715757C79, 00007FF715757C9B
Tcl_JoinThread, xrefs: 00007FF715757885, 00007FF7157578A7
Tcl_GetObjResult, xrefs: 00007FF715757B65, 00007FF715757B87
Tcl_EvalFile, xrefs: 00007FF715757B93, 00007FF715757BB5
Tcl_ConditionWait, xrefs: 00007FF715757999, 00007FF7157579BB
Tcl_MutexFinalize, xrefs: 00007FF71575790F, 00007FF715757931
Tcl_NewStringObj, xrefs: 00007FF715757ADB, 00007FF715757AFD
Tcl_CreateInterp, xrefs: 00007FF71575771B, 00007FF71575773D
Tcl_NewByteArrayObj, xrefs: 00007FF715757B09, 00007FF715757B2B
Tcl_Alloc, xrefs: 00007FF715757C1D, 00007FF715757C3F
Tcl_DeleteInterp, xrefs: 00007FF7157577FB, 00007FF71575781D
Tcl_GetCurrentThread, xrefs: 00007FF715757857, 00007FF715757879
Tcl_CreateObjCommand, xrefs: 00007FF715757A7F, 00007FF715757AA1
GetProcAddress, xrefs: 00007FF7157576FF
Failed to get address for %hs, xrefs: 00007FF7157576F8
Tcl_ConditionNotify, xrefs: 00007FF71575796B, 00007FF71575798D
Tcl_SetVar2Ex, xrefs: 00007FF715757B37, 00007FF715757B59
Tcl_Finalize, xrefs: 00007FF71575779F, 00007FF7157577C1
Tk_GetNumMainWindows, xrefs: 00007FF715757CA7, 00007FF715757CC9
Tcl_MutexLock, xrefs: 00007FF7157578B3, 00007FF7157578D5
Tcl_MutexUnlock, xrefs: 00007FF7157578E1, 00007FF715757903
Tcl_ConditionFinalize, xrefs: 00007FF71575793D, 00007FF71575795F
Tcl_Init, xrefs: 00007FF7157576D0, 00007FF7157576EF
Tcl_GetVar2, xrefs: 00007FF715757A23, 00007FF715757A45
Tcl_SetVar2, xrefs: 00007FF715757A51, 00007FF715757A73
Tcl_EvalEx, xrefs: 00007FF715757BC1, 00007FF715757BE3
Tcl_ThreadAlert, xrefs: 00007FF7157579F5, 00007FF715757A17
Tcl_Free, xrefs: 00007FF715757C4B, 00007FF715757C6D
Tcl_ThreadQueueEvent, xrefs: 00007FF7157579C7, 00007FF7157579E9

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: 6e2b680829aa92baa2912781b600d9008c28375ed2367b68d38b7cdffe94805c
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: A4029E61A19F0B91EA1CBB65B85A5B4E3A1AF0CFB5BC40035D92E16274BF3CB55DC230

Function 00007FF7157740AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7157740FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF715774766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7157748DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF715774B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF715774DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF715774FF7
memcpy_s.LIBCPMT ref: 00007FF7157750D2
memcpy_s.LIBCPMT ref: 00007FF71577517D
memcpy_s.LIBCPMT ref: 00007FF71577524C

Strings

1#IND, xrefs: 00007FF7157741E7
1#QNAN, xrefs: 00007FF715774213
1#SNAN, xrefs: 00007FF71577420A
1#INF, xrefs: 00007FF715774223

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction ID: c52ab271528a78956fb3b561a68af8232cd77cc73e0745858106027377b6c180
Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction Fuzzy Hash: 4EB21B72F186828BE7299F64E4497FCB7A2FB48B54F801135DA0D57A94DB38E90CCB50

Function 00007FF7157583C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF715758919,00007FF715753FA5), ref: 00007FF71575842B
RemoveDirectoryW.KERNEL32(?,00007FF715758919,00007FF715753FA5), ref: 00007FF7157584AE
DeleteFileW.KERNEL32(?,00007FF715758919,00007FF715753FA5), ref: 00007FF7157584CD
FindNextFileW.KERNEL32(?,00007FF715758919,00007FF715753FA5), ref: 00007FF7157584DB
FindClose.KERNEL32(?,00007FF715758919,00007FF715753FA5), ref: 00007FF7157584EC
RemoveDirectoryW.KERNEL32(?,00007FF715758919,00007FF715753FA5), ref: 00007FF7157584F5

Strings

%s\*, xrefs: 00007FF7157583F2

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: babc0f08f43185dca11d18f6951d4e22c31efd78150ff82a495bb2bc5f9da467
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: 71415521A2CD4286EA64BF55E45A2BAA370FB9CF64FD00231DA5D436A4EF3CD54DC710

Function 00007FF71575ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distance too far back, xrefs: 00007FF71575B670
invalid distance code, xrefs: 00007FF71575B5B4
invalid code -- missing end-of-block, xrefs: 00007FF71575B0C6
invalid literal/length code, xrefs: 00007FF71575B3E2
too many length or distance symbols, xrefs: 00007FF71575AE46
invalid code lengths set, xrefs: 00007FF71575AE2D
invalid distances set, xrefs: 00007FF71575B1A0
invalid literal/lengths set, xrefs: 00007FF71575B133
invalid bit length repeat, xrefs: 00007FF71575B099

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
Instruction ID: 661aaafe8083b20f6c9f15b3bfff92e7873a627a34d10b4cd8bab70e0c66d76b
Opcode Fuzzy Hash: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
Instruction Fuzzy Hash: 95523772A24BA64BE7A8AF14C449B7D7BB9FB48751F414138E64A83790DB7CD80CCB50

Function 00007FF71575D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF71575D148
RtlCaptureContext.KERNEL32 ref: 00007FF71575D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF71575D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF71575D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF71575D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF71575D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF71575D24C

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: 571c4afaf9c15caf7fcb5854fd04387115740e93e77fbee3ef9b37c06f41bf56
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 99313F72619F8186EB64AF60E8857ED6360FB88B18F844039DB4D47BA4EF78D64CC710

Function 00007FF71576A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF71576A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF71576A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF71576A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF71576A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF71576A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF71576A72E

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: af6ba6406ced3547f89eee689377e1e8d2202b5b1b1bf18275421b63397612a6
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 85317432618F8186EB649F25E8456AE73A4FB88B64F900135EB4D43B64EF3CC14DC710

Function 00007FF715771874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7157718C0
FindFirstFileExW.KERNEL32 ref: 00007FF7157719CA

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: 8104052b120e553bf3b8bfd5f52f3ae012dd4bd9afb2939415e5d69badfc26af
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: 61B1C922B18F8241EA69BB22B50A1B9E352EB48FF4F945131D94D07BA5DF3CE44DC310

Function 00007FF71575D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF71575D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF71575D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF71575D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF71575D066

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 4184ae59ed44c30825559ca9e1c8232c41027e64fd10543f23770685460c37bf
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: 98114F22B14F058AEB009B60E8462B973A4F71DB68F840E31DA1D46764EF38D15C8350

Function 00007FF715773C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF715773C76
memcpy_s.LIBCPMT ref: 00007FF715773CA1

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: d16e0da83707da3e6e51fc9d5f748ae18720c933a16125854b2b8d798458b2ee
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 3AC10672B18A8687E728DF15B04967AFB91F788B94F808134DB4E43794DB3DE909CB40

Function 00007FF71575A474 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00007FF71575A921
, xrefs: 00007FF71575A55B
unknown header flags set, xrefs: 00007FF71575A4C5

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
Instruction ID: 3f7e51b89436d6c95e1e8325dac0c4fdd67ef5874951b3bdda46c91fcbe2a03e
Opcode Fuzzy Hash: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
Instruction Fuzzy Hash: BBF1B572A24BD54BE7A9BF14C089B3ABAF9EF48B51F454538DA49073A0CB78E44CC750

Function 00007FF715779728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF715779977
RaiseException.KERNEL32 ref: 00007FF715779988

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction ID: 048769a873fe28082ec7d63d40fd66551a6ac727ec7658ae03be7b3d436fe41c
Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction Fuzzy Hash: C8B17E73A05B898BEB19CF29D84A36CB7A0F788F58F158821DA5D837B4CB39D459C710

Function 00007FF7157639A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF715763D54
, xrefs: 00007FF715763B12

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: e8e298fa6293287316d8f266c9a1f246f366548a6ba84b2a2842161e9e9ca6dc
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: 42E1B336A08E4285FB6CAE258152139A3A0FF49F68FA44335DA0E076F4DF29E85DD710

Function 00007FF71575A2DB Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF71575A45B
invalid window size, xrefs: 00007FF71575A442

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
Instruction ID: e940f4035b26d0fbcc6ff51e6fdd7213c2056f5c0dd081e6595bf355bdaf6c03
Opcode Fuzzy Hash: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
Instruction Fuzzy Hash: FA91DB72A287C687E7A8AE14C44DB3E7AB9FF48760F414139DA4A46790CB7CE54CCB50

Function 00007FF71576DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF71576E07A
e+000, xrefs: 00007FF71576DFFD

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: 5469157b6982ce7545d4cb0c0c494c6276343228e2b8c4e39e8c4074eb7ab523
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: 80519C62B18AC246F7289E359802769F791E748FA4F888731CBA847AE5CF7DD44C8710

Function 00007FF71576DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF71576DD9E

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 090f199c05eeebf77852ba3e1bc92da55cc9fa4305fc1677230d30eb820d08e5
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: DDA19962A18BC94AFB29DF25A0117A9BB91EB58FA0F408232DE4D477A5DF3DD44DC310

Function 00007FF715768794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7157687B3

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction ID: d5c8e4b14406a7bb90c4fba9c2659e46dd033d2ecf2872a0dcf2a39fa3b5867a
Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction Fuzzy Hash: 7C518E41B18B0341FA6CBA27A51717A92D1AF4CFE4F984235DE0E577A6EF3CE44D4260

Function 00007FF715773480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF715773484

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: 9e6a57316d9991edae8029c2247873dab0ab636d779ecfe1c8f7a797178d561b
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: FCB09220E07E02C2EA0C3B216C8BA28A3A4BF4CB21FD80138C10D40330EF2C24ED5720

Function 00007FF7157635A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction ID: 73be703d50c4027fa8f9e6f05947ff6fd4fcd4615d744b73a93ca96a52dcc167
Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction Fuzzy Hash: 6DD1C662A08E4246FB6CAE29805627DA7A0EF49F68F944335CE0D077A5DF3DD84DC760

Function 00007FF715759800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction ID: ec4d52b4622eb6d708be369c4ff515e490b638449965203164a714750f13cf15
Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction Fuzzy Hash: 22C180762241E08BD28AEB29E47947A73E1F78930DBD5406BEF8747785C73CA418D720

Function 00007FF715762C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: ea78eeb44b6e14cc2932052e59d6f9907ee8a6e480226049145671796ddd8dca
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: 02B1AE72A08B9685F7A99F29C05527CBBA0E74DF68FA40235CA4E473A5CF39D44DC720

Function 00007FF71576E570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: 314ba16609fde377943fe0fe327be3a4c9d2a69585bfb5f126d5ad8b243d2d38
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: 0A810872A08B814AF778DF19944236BA691FB49BA0F944735DE8D43BA5DF3CD40C8B20

Function 00007FF715776418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
Instruction ID: 0eda03ec9f4b92051dc1a19c2ab3e7ff514b357abb0645ccc43fa22406670182
Opcode Fuzzy Hash: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
Instruction Fuzzy Hash: 67611F21E08A5246F76CAA25A05A67CF791AF48F74FD40239D61D836EDDF6DE80C8720

Function 00007FF715761D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 2c4482b9f2c28eba01effe9bbdbae06f413dfd74d33395b984e6aeda1214cb27
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 6E519576A18E5282F7289B29D04926873A0EB49F78F644331CE4D077B4CB3AE85FC750

Function 00007FF715761944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 843dd7adf11e38803e6ed8c385f1a2d07e50900e49985f2943c533d3fd918e28
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 2C518736A14F5185F7289B29D049638B7A0EB48F78F645231CA8D577B4CB3AE84FC750

Function 00007FF715762164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 5140f11b7827fd2d860c352437788b03511e94001f5080ef026e23aa39309e7e
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 05519836A18A5286F7A89B29C44163C73A1EB5CF78F644231CA4C177B4CB3AE84FC750

Function 00007FF715761740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: d98e3a9aaa5efc361593c8daa0e19f799f6213c9b51a09c471e15aa20368e546
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: AA518636A14A5685F7289B29D04923877A1EB59F78F644231CE4C177A4CF3AEC4AC750

Function 00007FF715761F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: c7e48b097b10824517e49e95b9f2b260684c6d89d0d355bacfe3c31fc9bf07e6
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: E251D472A19A5286F7689B29D04527CA3A0EB4CF68F644231CE4D177B5CB3AE84FC750

Function 00007FF715761B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: 2b3f8d14a34e461cbca41bd60a4940179a9d918a00392e6ba3feba5390c5c1ba
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: B051D532A18E5185F7289F29E05923C67A0EB89F68F644231CE4C177A4DF3AE84EC750

Function 00007FF715765D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: dedc8873d0bb12bbd422f226c1477a0b09ef37dc84ab8f179dc59ccafefde30b
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 6941C57290DF5A05FDAD991805096B8A6809F1AFB0DD813B4DDAD1B3F7CF0DA58ED120

Function 00007FF715769EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction ID: a330bef06a9e5719f4f854e7a54c813273cac0d5b8b022db58bf1b4caa18a90d
Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction Fuzzy Hash: DD411362714E5582EF08DF2AD9161A9A391F74CFE4B999432EE0D97B64DF3DC04A8300

Function 00007FF7157680E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: d235e338666cde8d5901cf055e7f0ef945e387ba6e46d73a3604d185dd0379f8
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: 1431D472718F4281F76CAF25A44612EA6D5AB88FE0F544238EA4D53BE5DF3CD4098714

Function 00007FF715779570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: f009b628742f5b20317cea5b3db3bcb3cbc0a0cbe9a74ecea7e258b320727600
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: 69F044717186958ADB9C9F7DA44362977D0F708790F809039D58D83A14DB3C90658F24

Function 00007FF71575D30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: 128eea689345e135a69b180c9b5addd7583d181d7dc3660426e41379990e7169
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: 42A00221D1DC0AD0E64CAB00F896435A330FB5CB28BC00071E20E514B0BF3DA54DD320

Function 00007FF715755830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF715755840
GetLastError.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF715755852
GetProcAddress.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF715755889
GetLastError.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF71575589B
GetProcAddress.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF7157558B4
GetLastError.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF7157558C6
GetProcAddress.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF7157558DF
GetLastError.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF7157558F1
GetProcAddress.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF71575590D
GetLastError.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF71575591F
GetProcAddress.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF71575593B
GetLastError.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF71575594D
GetProcAddress.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF715755969
GetLastError.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF71575597B
GetProcAddress.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF715755997
GetLastError.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF7157559A9
GetProcAddress.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF7157559C5
GetLastError.KERNEL32(?,00007FF7157564CF,?,00007FF71575336E), ref: 00007FF7157559D7

Strings

PyPreConfig_InitIsolatedConfig, xrefs: 00007FF715755DDD, 00007FF715755DFF
PyObject_CallFunctionObjArgs, xrefs: 00007FF715755D25, 00007FF715755D47
Py_DecRef, xrefs: 00007FF715755836, 00007FF715755858
PyStatus_Exception, xrefs: 00007FF715755E39, 00007FF715755E5B
PyObject_SetAttrString, xrefs: 00007FF715755D81, 00007FF715755DA3
PyRun_SimpleStringFlags, xrefs: 00007FF715755E0B, 00007FF715755E2D
PyObject_CallFunction, xrefs: 00007FF715755CF7, 00007FF715755D19
Py_Finalize, xrefs: 00007FF7157558D5, 00007FF7157558F7
Py_IsInitialized, xrefs: 00007FF715755931, 00007FF715755953
PyObject_Str, xrefs: 00007FF715755DAF, 00007FF715755DD1
PyConfig_SetBytesString, xrefs: 00007FF715755A17, 00007FF715755A39
PyErr_Fetch, xrefs: 00007FF715755ACF, 00007FF715755AF1
PyUnicode_FromFormat, xrefs: 00007FF715755F4D, 00007FF715755F6F
PyConfig_SetWideStringList, xrefs: 00007FF715755A73, 00007FF715755A95
Py_DecodeLocale, xrefs: 00007FF71575587F, 00007FF7157558A1
GetProcAddress, xrefs: 00007FF715755868
PyUnicode_FromString, xrefs: 00007FF715755F7B, 00007FF715755F9D
Py_ExitStatusException, xrefs: 00007FF7157558AA, 00007FF7157558CC
PySys_SetObject, xrefs: 00007FF715755E95, 00007FF715755EB7
Py_PreInitialize, xrefs: 00007FF71575595F, 00007FF715755981
Failed to get address for %hs, xrefs: 00007FF715755861
PyImport_ExecCodeModule, xrefs: 00007FF715755C11, 00007FF715755C33
PyConfig_SetString, xrefs: 00007FF715755A45, 00007FF715755A67
PySys_GetObject, xrefs: 00007FF715755E67, 00007FF715755E89
Py_InitializeFromConfig, xrefs: 00007FF715755903, 00007FF715755925
PyErr_Occurred, xrefs: 00007FF715755B2B, 00007FF715755B4D
PyUnicode_AsUTF8, xrefs: 00007FF715755EC3, 00007FF715755EE5
PyImport_AddModule, xrefs: 00007FF715755BE3, 00007FF715755C05
PyUnicode_Decode, xrefs: 00007FF715755EF1, 00007FF715755F13
PyObject_GetAttrString, xrefs: 00007FF715755D53, 00007FF715755D75
PyMem_RawFree, xrefs: 00007FF715755C9B, 00007FF715755CBD
PyConfig_Read, xrefs: 00007FF7157559E9, 00007FF715755A0B
PyImport_ImportModule, xrefs: 00007FF715755C3F, 00007FF715755C61
PyMarshal_ReadObjectFromString, xrefs: 00007FF715755C6D, 00007FF715755C8F
PyEval_EvalCode, xrefs: 00007FF715755BB5, 00007FF715755BD7
PyErr_Restore, xrefs: 00007FF715755B87, 00007FF715755BA9
PyConfig_Clear, xrefs: 00007FF71575598D, 00007FF7157559AF
PyConfig_InitIsolatedConfig, xrefs: 00007FF7157559BB, 00007FF7157559DD
PyErr_Clear, xrefs: 00007FF715755AA1, 00007FF715755AC3
PyUnicode_Replace, xrefs: 00007FF715755FD7, 00007FF715755FF9
PyUnicode_DecodeFSDefault, xrefs: 00007FF715755F1F, 00007FF715755F41
PyModule_GetDict, xrefs: 00007FF715755CC9, 00007FF715755CEB
PyErr_Print, xrefs: 00007FF715755B59, 00007FF715755B7B
PyUnicode_Join, xrefs: 00007FF715755FA9, 00007FF715755FCB
PyErr_NormalizeException, xrefs: 00007FF715755AFD, 00007FF715755B1F

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 77d5e1adcac2574c7d64eb8c6586d0f75231873ffe9f4280fb427e49c0eb078e
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: 1F228B64A19F0791FA5CBB65B85A5B4A3A4AF0CFB5BC41039C91E422B0BF3CB55CC270

Function 00007FF7157581D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF715759390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7157545F4,00000000,00007FF715751985), ref: 00007FF7157593C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7157586B7,?,?,00000000,00007FF715753CBB), ref: 00007FF71575822C

Part of subcall function 00007FF715752810: MessageBoxW.USER32 ref: 00007FF7157528EA

Strings

\, xrefs: 00007FF715758261
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF715758373
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF715758203
%.*s, xrefs: 00007FF71575830C
CreateDirectory, xrefs: 00007FF71575837C
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF71575829D
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7157582D9
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF715758240

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction ID: adb8e81ec5dbcdbf52b2edfbaac1459a89ce6eb2f4a3a83c4d3758fdfd25eefe
Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction Fuzzy Hash: F3516611A38E4241FA58BB25E8576B9E360AF9CFA0FD44431E70E426F5EF2CE50C8760

Function 00007FF715752180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7157521AB
SelectObject.GDI32 ref: 00007FF7157521F2
DrawTextW.USER32 ref: 00007FF715752215
SelectObject.GDI32 ref: 00007FF71575222B
ReleaseDC.USER32 ref: 00007FF71575223B
MoveWindow.USER32 ref: 00007FF71575228B
MoveWindow.USER32 ref: 00007FF7157522CB
MoveWindow.USER32 ref: 00007FF71575231E
MoveWindow.USER32 ref: 00007FF715752366

Strings

P%, xrefs: 00007FF7157521FF

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 530830887b9b565ddd09b54cce59bf14f54fdf251c9e2e1d150bf627514ccc9d
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 5551F526614BA186D6289F26B41C1BAB7A1FB9CB65F404135EFDE43694EF3CD049CB20

Function 00007FF7157580C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7157580FF
GetWindowLongPtrW.USER32 ref: 00007FF71575817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF715758192
GetLastError.KERNEL32 ref: 00007FF71575819C
SetWindowLongPtrW.USER32 ref: 00007FF7157581B3

Strings

Needs to remove its temporary files., xrefs: 00007FF715758185

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 757bed0d736734d1a2fa6e8bfc9b6e08e0f49308c85a88d857bc0057a303363c
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: D4213721B28E4282E6496B7AB859179A360FF4CFB0F984135DB1D473B4EF2CD59D8321

Function 00007FF715766290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7157662D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7157666C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71576695C

Strings

:, xrefs: 00007FF71576648C
p, xrefs: 00007FF715766385
p, xrefs: 00007FF7157663FD
-, xrefs: 00007FF715766369
f, xrefs: 00007FF7157663F5

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: ad6a27f59472bdb5fa1e7a654c099ecfd3de3e5fda8e2201064360ec219ef21c
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: E812D671E0CA4386FB287E15E116679F692FB48F60FC44235D689466E4DF3CE98C8B21

Function 00007FF715760FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715761008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7157613D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71576166F

Strings

p, xrefs: 00007FF715761112
f, xrefs: 00007FF715761255
f, xrefs: 00007FF71576110A
p, xrefs: 00007FF7157610AD
f, xrefs: 00007FF7157610A0

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: a04244ce74188828c8c93430c266de8f810f5ccc43886ab66c0b82c42cb02984
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 9C129461E1C94385FB28BA15F05A279F6A1FB44F60FC84235D68A479E4DF7CE48C8B20

Function 00007FF715751050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF715751108
Failed to extract %s: failed to open archive file!, xrefs: 00007FF715751098
fread, xrefs: 00007FF7157511FD
malloc, xrefs: 00007FF71575110F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7157510CC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7157511F6
fseek, xrefs: 00007FF7157510D3

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: ff5b4fad13ef8aaee9d991072cb01505e6ede49a985447baf4eec0a072074c38
Instruction ID: f6988cb969041f26f69b2c5af97277b9a180ac5d208b3c9821d5c89154ed30ba
Opcode Fuzzy Hash: ff5b4fad13ef8aaee9d991072cb01505e6ede49a985447baf4eec0a072074c38
Instruction Fuzzy Hash: 57418261B28A5285FA18FB12A8465B9E3A1BF48FE4FC44531ED4C077A5DF3CE50D8760

Function 00007FF715751470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF715751518
Failed to extract %s: failed to open archive file!, xrefs: 00007FF71575149F
fread, xrefs: 00007FF7157515E6
malloc, xrefs: 00007FF71575151F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7157514DE
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7157515DF
fseek, xrefs: 00007FF7157514E5

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 1a2ba8a856b3fca217ae97ea7c4189b5fa745fbbe5bd2f21962a353e35730f78
Instruction ID: b0d2092d73608b7882515d4baf22f346914c7b7a5ddc5594e6f1316aa9ee1411
Opcode Fuzzy Hash: 1a2ba8a856b3fca217ae97ea7c4189b5fa745fbbe5bd2f21962a353e35730f78
Instruction Fuzzy Hash: DD417721B18A4285EA18EB22A4465B5E3A1AF4CFA4FC44532ED4D077B5DF3CE54DC760

Function 00007FF71575EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF71575EA65

Part of subcall function 00007FF71575F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF71575F9FF
Part of subcall function 00007FF71575F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF71575FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF71575EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF71575ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71575EE98

Strings

csm, xrefs: 00007FF71575EB60
csm, xrefs: 00007FF71575EA7F
csm, xrefs: 00007FF71575EAE6

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: ff95c81d5d0be0ee537d508910331399e13ec52ab0e7372456e684a0027ddb5f
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 88D1C232928B418AEB24AB25D4423ADB7B0FB48BA8F904575DE4D57765DF38E08CC710

Function 00007FF71576ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF71576F0AA,?,?,000001E955DD8BE8,00007FF71576AD53,?,?,?,00007FF71576AC4A,?,?,?,00007FF715765F3E), ref: 00007FF71576EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF71576F0AA,?,?,000001E955DD8BE8,00007FF71576AD53,?,?,?,00007FF71576AC4A,?,?,?,00007FF715765F3E), ref: 00007FF71576EE98

Strings

api-ms-, xrefs: 00007FF71576EDD6
ext-ms-, xrefs: 00007FF71576EDE9

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 7aa7620db517415acdfc2d1263bcd6eda08b70b0f95d696982afdd06b1f9abcf
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 1141D421B19E1249FA1AAB16A806576A391BF4DFB0FC84A35DD1D477A4EF3CE40D8320

Function 00007FF715752C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF715753706,?,00007FF715753804), ref: 00007FF715752C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF715753706,?,00007FF715753804), ref: 00007FF715752D63
MessageBoxW.USER32 ref: 00007FF715752D99

Strings

Error, xrefs: 00007FF715752D8C
%ls: , xrefs: 00007FF715752D22
[PYI-%d:ERROR] , xrefs: 00007FF715752CA6
<FormatMessageW failed.>, xrefs: 00007FF715752D70

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: d6bbbeecdd1f522ea1fd0be928a6ecc04cafd65fe2c1160d17af6fcc137a465a
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 9031B622704F5142E624BB25B8156BAA7A5BB8CBA8F814135EF4D53769EF3CD50EC310

Function 00007FF71575DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF71575DF7A,?,?,?,00007FF71575DC6C,?,?,?,00007FF71575D869), ref: 00007FF71575DD4D
GetLastError.KERNEL32(?,?,?,00007FF71575DF7A,?,?,?,00007FF71575DC6C,?,?,?,00007FF71575D869), ref: 00007FF71575DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF71575DF7A,?,?,?,00007FF71575DC6C,?,?,?,00007FF71575D869), ref: 00007FF71575DD85
FreeLibrary.KERNEL32(?,?,?,00007FF71575DF7A,?,?,?,00007FF71575DC6C,?,?,?,00007FF71575D869), ref: 00007FF71575DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF71575DF7A,?,?,?,00007FF71575DC6C,?,?,?,00007FF71575D869), ref: 00007FF71575DDFF

Strings

api-ms-, xrefs: 00007FF71575DD6D

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 111e9c7b7ab24b62c1a59a733b7868660fe2af1e960c6075f49ac87a38c2fdfe
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 6D319561B2AF5291EE19BB02A4025B5A3A4FF4CFB4FD94536DD1D063A4EF3CE54D8220

Function 00007FF715756360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Failed to load Python DLL '%ls'., xrefs: 00007FF7157564A7
ucrtbase.dll, xrefs: 00007FF7157563DD
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7157563C7
LoadLibrary, xrefs: 00007FF7157564AE
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF715756456
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF715756407

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: bd35b640c02035bc0e077a05b147b005ab0e639f37cafda848bc65a29b3ec2f1
Instruction ID: 421fea98dc5bd6598a7fec6face8bad1549ab8b6cb4dfc55c5332cf0e9a16b49
Opcode Fuzzy Hash: bd35b640c02035bc0e077a05b147b005ab0e639f37cafda848bc65a29b3ec2f1
Instruction Fuzzy Hash: 0F415721A28E8691EA19FB10F4161E9A325FF4CB64FD00132EA5D476B5DF3CE60DC760

Function 00007FF715752A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF71575351A,?,00000000,00007FF715753F23), ref: 00007FF715752AA0

Strings

[PYI-%d:%s] , xrefs: 00007FF715752AA8
Warning [ANSI Fallback], xrefs: 00007FF715752B0F
Warning, xrefs: 00007FF715752B1E
WARNING, xrefs: 00007FF715752AAF
0, xrefs: 00007FF715752B16

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: d4069fa944eeff7be0711200930ab19c93aee73aa6a647bb00031d6ed41e31c8
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 7721A332A18B8152E724AB51F4467E6A3A4FB8CB94F800135FE8C43669DF3CD14DC750

Function 00007FF71576B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF71576B15F
FlsGetValue.KERNEL32 ref: 00007FF71576B174
FlsSetValue.KERNEL32 ref: 00007FF71576B195
FlsSetValue.KERNEL32 ref: 00007FF71576B1C2
FlsSetValue.KERNEL32 ref: 00007FF71576B1D3
FlsSetValue.KERNEL32 ref: 00007FF71576B1E4
SetLastError.KERNEL32 ref: 00007FF71576B1FF

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction ID: fd79e5e267bbfa6c3157921d2d6e77847ea492f72242b295d446a1e7ebe92f0b
Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction Fuzzy Hash: 67213A20F18A4295FA6C73229A57139D2825F4DFB0FD44B34D93E46AEADF2CB40D8320

Function 00007FF715777D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF715777D9D
GetLastError.KERNEL32 ref: 00007FF715777DA9
CloseHandle.KERNEL32 ref: 00007FF715777DC1
CreateFileW.KERNEL32 ref: 00007FF715777DEC
WriteConsoleW.KERNEL32 ref: 00007FF715777E0B

Strings

CONOUT$, xrefs: 00007FF715777DCD

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: b40dd883bde659243fce834abab898ac68dccad6768cee19c1267e6f5a165089
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 68117C21A18E4186E754AB12B85A339E3A0BB8CFF4F800634EA5D877B4DF7CD81C8750

Function 00007FF715758ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF715753FB1), ref: 00007FF715758EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF715753FB1), ref: 00007FF715758F5A

Part of subcall function 00007FF715759390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7157545F4,00000000,00007FF715751985), ref: 00007FF7157593C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF715753FB1), ref: 00007FF715758FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF715753FB1), ref: 00007FF715759044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF715753FB1), ref: 00007FF715759055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF715753FB1), ref: 00007FF71575906A

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction ID: 2d5c499e5394d881743a2a2b0386cedebd3b481aa8cbb776d017741f13cb723b
Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction Fuzzy Hash: 2E41C861A29A8281EA34AB11E4012BAB3A5FB8DFE4F840535EF4D577A9DF3CD50CC710

Function 00007FF71576B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF715764F11,?,?,?,?,00007FF71576A48A,?,?,?,?,00007FF71576718F), ref: 00007FF71576B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF715764F11,?,?,?,?,00007FF71576A48A,?,?,?,?,00007FF71576718F), ref: 00007FF71576B30D
FlsSetValue.KERNEL32(?,?,?,00007FF715764F11,?,?,?,?,00007FF71576A48A,?,?,?,?,00007FF71576718F), ref: 00007FF71576B33A
FlsSetValue.KERNEL32(?,?,?,00007FF715764F11,?,?,?,?,00007FF71576A48A,?,?,?,?,00007FF71576718F), ref: 00007FF71576B34B
FlsSetValue.KERNEL32(?,?,?,00007FF715764F11,?,?,?,?,00007FF71576A48A,?,?,?,?,00007FF71576718F), ref: 00007FF71576B35C
SetLastError.KERNEL32(?,?,?,00007FF715764F11,?,?,?,?,00007FF71576A48A,?,?,?,?,00007FF71576718F), ref: 00007FF71576B377

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction ID: da1c95f592e9f94fab503a2bdaa684e4a3104ce4657d9d41e8fc09a4c8933270
Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction Fuzzy Hash: 4E11E820B08A4286FA5C7722569713DA2429F4EFB0FD44734D92E566F6EF2CA44D4320

Function 00007FF715752910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF715751B6A), ref: 00007FF71575295E

Strings

Error, xrefs: 00007FF715752A0E
%s: %s, xrefs: 00007FF7157529E8
Error [ANSI Fallback], xrefs: 00007FF7157529FF
[PYI-%d:ERROR] , xrefs: 00007FF715752966

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: cab3b21243dbc9ad5aa7f6b4b38ae71f85f151050d95f31821030396a8aaf6d3
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: 7031E762B18A8156E714B761B8466E6A395BF8CBE4F800131FE8D83765EF3CD14EC210

Function 00007FF715752390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7157523C8
DialogBoxIndirectParamW.USER32 ref: 00007FF71575248E
DeleteObject.GDI32 ref: 00007FF7157524C1
DestroyIcon.USER32 ref: 00007FF7157524D3

Strings

Unhandled exception in script, xrefs: 00007FF7157523F8

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction ID: d08557a8b8821b8973906fc3cb3192a557759d083e2f1293ba88e33c822750c1
Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction Fuzzy Hash: CC316671619A8145EB14EB61E85A2F9A360FF8DB94F840135EA4D47B69DF3CD10CC710

Function 00007FF715752B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF71575918F,?,00007FF715753C55), ref: 00007FF715752BA0
MessageBoxW.USER32 ref: 00007FF715752C2A

Strings

WARNING, xrefs: 00007FF715752BAF
[PYI-%d:%ls] , xrefs: 00007FF715752BA8
Warning, xrefs: 00007FF715752C1D

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: b164889b1a51222d2602df30cd012d71220f481946d50d561e46b8f935db4d4d
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: CC21D162718F4152E714AB14F84A7AAA3A4EB8CB90F800136EE8D53665EF3CD20DC750

Function 00007FF715752710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF715751B99), ref: 00007FF715752760

Strings

Error, xrefs: 00007FF7157527DE
[PYI-%d:%s] , xrefs: 00007FF715752768
Error [ANSI Fallback], xrefs: 00007FF7157527CF
ERROR, xrefs: 00007FF71575276F

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: f8a240d05b6480500e0115a94048b92f56d44e91395bef506ea5564446eca99c
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: 4121B572A18B8152E714EB50F4467E6A3A4FB8CB94F800131FE8C43669DF7CD24D8750

Function 00007FF715769A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF715769AAD
GetProcAddress.KERNEL32 ref: 00007FF715769AC3
FreeLibrary.KERNEL32 ref: 00007FF715769AEA

Strings

mscoree.dll, xrefs: 00007FF715769AA4
CorExitProcess, xrefs: 00007FF715769ABC

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: 088829dc2ad7aa57635dd163ac829151c3dc0c026bc3bd15e1482644e4e8e06f
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: 4BF04F65B19E0681FA18AB24A48A37AA360EF4DB75F940235D66E465F4EF2CD08CD320

Function 00007FF715779368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF715779390
_set_statfp.LIBCMT ref: 00007FF7157793AB
_set_statfp.LIBCMT ref: 00007FF7157793C7
_set_statfp.LIBCMT ref: 00007FF715779403

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 260963370611d529cd9f238b2c983d88c04dd8ac365ff522e6c71ffa8d8739b4
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 0E119032E4AE0201FA6C7169F49B3799241EF5DF74E850635EA6E062F69F6CA84D8120

Function 00007FF71576B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF71576A5A3,?,?,00000000,00007FF71576A83E,?,?,?,?,?,00007FF71576A7CA), ref: 00007FF71576B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF71576A5A3,?,?,00000000,00007FF71576A83E,?,?,?,?,?,00007FF71576A7CA), ref: 00007FF71576B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF71576A5A3,?,?,00000000,00007FF71576A83E,?,?,?,?,?,00007FF71576A7CA), ref: 00007FF71576B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF71576A5A3,?,?,00000000,00007FF71576A83E,?,?,?,?,?,00007FF71576A7CA), ref: 00007FF71576B407
FlsSetValue.KERNEL32(?,?,?,00007FF71576A5A3,?,?,00000000,00007FF71576A83E,?,?,?,?,?,00007FF71576A7CA), ref: 00007FF71576B418

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction ID: 36773c6da56388b01968d7cfae285b9977b982a9ee67f57f3cd389289074099b
Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction Fuzzy Hash: 33113D20F08E4281FA5CB7269557179A2419F4DFB0FD84734E93D566FADF2CB44D8220

Function 00007FF71576B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF71576B235
FlsSetValue.KERNEL32 ref: 00007FF71576B254
FlsSetValue.KERNEL32 ref: 00007FF71576B27C
FlsSetValue.KERNEL32 ref: 00007FF71576B28D
FlsSetValue.KERNEL32 ref: 00007FF71576B29E

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction ID: 0f762ac83b0baea3b733f492efe881b6b5454d46190f6d2a6ccea70e6191c81e
Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction Fuzzy Hash: 6B11B320F08A0689FAAC7262445797A92824F4EB70FD84B34D93E5A6E6DF2CB44D4631

Function 00007FF715765FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715765FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF715766106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7157661BC

Strings

verbose, xrefs: 00007FF715765FB0

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: aa33bb63ba40bf0b9bca1274c1dd06b2de49579e32e4770caf636f40872cf42a
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: DB91C022A08E4685FB29AE25D45277DB695AB48F64FC44332DA5D433E6DF3CE84D8320

Function 00007FF71576FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71576FEA7

Part of subcall function 00007FF715767A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF715767A59

Strings

UTF-16LEUNICODE, xrefs: 00007FF71576FE45
UTF-8, xrefs: 00007FF71576FE26
ccs, xrefs: 00007FF71576FDE2

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: f8ce9560e032b4daf001d7dcad4b3ea099dcea8f3c7c8c7f23730e55e57f3ec4
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 9E81C872E0895385F76C7E29C123278A6A0AB1DF64FD55231C929972BDCF2DF80D9321

Function 00007FF71575D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71575D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF71575D70A
RtlUnwindEx.KERNEL32 ref: 00007FF71575D764

Strings

csm, xrefs: 00007FF71575D6F1

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 713d753cfc05b0f581c7ec32643ac6269806788b014808ac5d21bbb62b736bc4
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 5B51D532B29A028ADB18EF25E405678B3A1FB48FA4F904534DA4D47764EF7CE94EC750

Function 00007FF71575EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF71575EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF71575EF83

Strings

MOC, xrefs: 00007FF71575EF4B
RCC, xrefs: 00007FF71575EF53

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: 1f4723bc07a88f2489052a7999e09b8d473685a5e6886d2ca0dbdc3847208c9a
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 0561D472918BC485E764EF15E4413AAF7A0FB88BA4F444625EB9C037A5DF7CD188CB10

Function 00007FF71575F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71575F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF71575F398

Strings

csm, xrefs: 00007FF71575F3EA
csm, xrefs: 00007FF71575F2D2

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 25821a5dd82af65ac2d4b7025a2b2d4d3e19c3f4d6fe080cc39a4101e6a8929d
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: BE51B5B2528A4286EB28AB21D14537CB7B0EB58FA4F944135DB6C43BA5CF3CE45CC710

Function 00007FF715752810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7157528EA

Strings

Error, xrefs: 00007FF7157528DD
[PYI-%d:%ls] , xrefs: 00007FF715752868
ERROR, xrefs: 00007FF71575286F

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 1645623ebf8500359adab16446b50a207b9a4ad81aa951f14f2c3d2dc794bb4b
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: D821D162B18F4182E714AB54F44A7EAA3A4EB8CB90F800136EE8D53665EF3CD24DC750

Function 00007FF71576C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF71576C61F
WriteFile.KERNEL32 ref: 00007FF71576C8E7
WriteFile.KERNEL32 ref: 00007FF71576C92D
GetLastError.KERNEL32 ref: 00007FF71576C9E3

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: a5ba18b0ec9571bfdc5338ef2080024e891b5d7b5af3138989b6ef488639ae05
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 99D1EF72F08B8189E714DF65D4452AC77B5FB18BA8B804226DE4D97BA9DB38D40EC710

Function 00007FF7157520C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7157520F4
SetWindowLongPtrW.USER32 ref: 00007FF715752116
GetWindowLongPtrW.USER32 ref: 00007FF715752140
InvalidateRect.USER32 ref: 00007FF715752160

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 3e133e9702ec484f68ea8151ce601303bfc9b5e95f72574b32597407b51286e7
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: E811A921B2C94642F658A769F54A27E9361EF9CFA0FC48030EB4D07BA9DF2DD49D8210

Function 00007FF715775B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF715771760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF715771793

_get_daylight.LIBCMT ref: 00007FF715775C34
_get_daylight.LIBCMT ref: 00007FF715775C45

Strings

?, xrefs: 00007FF715775BC5

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: 0b6c181c9f38a1aa4b7878905e4da7d74597d84460e3bc6d4b1cb548d660dbe1
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: 9C412A12A08AC247F768A726B40A379E751EB89FB4F944235EE5C06AF5DF3CD44D8710

Function 00007FF715769014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715769046

Part of subcall function 00007FF71576A948: RtlFreeHeap.NTDLL(?,?,?,00007FF715772D22,?,?,?,00007FF715772D5F,?,?,00000000,00007FF715773225,?,?,?,00007FF715773157), ref: 00007FF71576A95E
Part of subcall function 00007FF71576A948: GetLastError.KERNEL32(?,?,?,00007FF715772D22,?,?,?,00007FF715772D5F,?,?,00000000,00007FF715773225,?,?,?,00007FF715773157), ref: 00007FF71576A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF71575CBA5), ref: 00007FF715769064

Strings

C:\Users\user\Desktop\user.exe, xrefs: 00007FF715769052

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\user.exe
API String ID: 3580290477-404738603
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: cc8c3da598c799945dffd6a6dfe17529b9cc2d2bff5376b3e3ea315889c63738
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: 0B416C36A08F0285FB1DBF2594420BCA795EB48FA0B954135EA4E43BA5DF38E48D8360

Function 00007FF71576CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF71576CD4F
GetLastError.KERNEL32 ref: 00007FF71576CD71

Strings

U, xrefs: 00007FF71576CCFB

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: ebe27186db8a2ab3873fd22d6834ccfc44458394dd9fb6f692643b215066bb03
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: 6F41B432B18E4185EB24AF25E4563B9B764FB88BA4F944131EE4D877A4EF3CD409C760

Function 00007FF71576F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF71576F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF71576F64A

Strings

:, xrefs: 00007FF71576F60E

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction ID: 78fd4f3da5827842af186ff5baa65327fc167617d7c2993e0eb78468e7d8bcf6
Opcode Fuzzy Hash: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction Fuzzy Hash: 1321E362A08A4181FB28AF11D04A26DA3A1FB8CF54FD54235DA5D432A8DF7CD94C8761

Function 00007FF71575FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF71575FD98
RaiseException.KERNEL32 ref: 00007FF71575FDD9

Strings

csm, xrefs: 00007FF71575FDC6

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: caad3cedabacc770eca52912bb8c91f8321186ddf39992a9a655fd82c4a02269
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: A5114C32619F8182EB259F15F404269B7E4FB8CB94F584230DB8D07768DF3CD5598B00

Function 00007FF71577073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71577076C
GetDriveTypeW.KERNEL32 ref: 00007FF7157707AC

Strings

:, xrefs: 00007FF715770795

Memory Dump Source

Source File: 00000000.00000002.3408300801.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000000.00000002.3408284906.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408325398.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408350102.00007FF715792000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3408380809.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff715750000_user.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 86c1f11d98b05af4c775e42fc1d002f4fe186bc038a949b893c42b29d90a3065
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 90018865918A0389FB29BF60A46F27EA3A0EF4CB64FD41535D54D426A1DF2CD50CCF24

Analysis Process: user.exePID: 420, Parent PID: 2448COMMON

Executed Functions

Function 00007FFD93C08A30 Relevance: 591.1, APIs: 57, Strings: 280, Instructions: 1345
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PySys_GetObject.PYTHON313 ref: 00007FFD93C08A5A
PyLong_AsUnsignedLongMask.PYTHON313 ref: 00007FFD93C08A68
PyErr_Occurred.PYTHON313 ref: 00007FFD93C08A75
PyErr_Clear.PYTHON313 ref: 00007FFD93C08AA1
?PyWinGlobals_Ensure@@YAHXZ.PYWINTYPES313 ref: 00007FFD93C08ABE
PyModule_Create2.PYTHON313 ref: 00007FFD93C08AD5
PyModule_GetDict.PYTHON313 ref: 00007FFD93C08AE6
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C08B0E
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C08B25
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C08B3C
PyType_Ready.PYTHON313 ref: 00007FFD93C08B4C
PyType_Ready.PYTHON313 ref: 00007FFD93C08B65
PyType_Ready.PYTHON313 ref: 00007FFD93C08B7E
PyType_Ready.PYTHON313 ref: 00007FFD93C08B97
_Py_NewReference.PYTHON313 ref: 00007FFD93C08BBA
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C08BD4
_Py_NewReference.PYTHON313 ref: 00007FFD93C08BEE
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C08C08
_Py_NewReference.PYTHON313 ref: 00007FFD93C08C22
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C08C3C
_Py_NewReference.PYTHON313 ref: 00007FFD93C08C56
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C08C70
PyErr_SetString.PYTHON313 ref: 00007FFD93C08C96
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C08CAE
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C08CC9
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C08CEB
PyErr_NewException.PYTHON313 ref: 00007FFD93C08D05
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C08D1F
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFD93C08D48
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C08D63
_Py_Dealloc.PYTHON313 ref: 00007FFD93C08D79
PyType_Ready.PYTHON313 ref: 00007FFD93C08D93
PyType_Ready.PYTHON313 ref: 00007FFD93C08DA9
PyType_Ready.PYTHON313 ref: 00007FFD93C08DBF
PyType_Ready.PYTHON313 ref: 00007FFD93C08DD5
PyType_Ready.PYTHON313 ref: 00007FFD93C08DEB
PyModule_Create2.PYTHON313 ref: 00007FFD93C08E06
PyDict_New.PYTHON313 ref: 00007FFD93C08E18
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C08E32
GetModuleHandleW.KERNEL32 ref: 00007FFD93C08E3F
GetProcAddress.KERNEL32 ref: 00007FFD93C08E57
GetProcAddress.KERNEL32 ref: 00007FFD93C08E6E
GetProcAddress.KERNEL32 ref: 00007FFD93C08E85
GetProcAddress.KERNEL32 ref: 00007FFD93C08E9C
GetProcAddress.KERNEL32 ref: 00007FFD93C08EB3
GetModuleHandleW.KERNEL32 ref: 00007FFD93C08EC7
LoadLibraryExW.KERNEL32 ref: 00007FFD93C08ED9

Part of subcall function 00007FFD93C089C0: PyLong_FromLong.PYTHON313 ref: 00007FFD93C089D8

Part of subcall function 00007FFD93C089C0: PyDict_SetItemString.PYTHON313 ref: 00007FFD93C08A02
Part of subcall function 00007FFD93C089C0: _Py_Dealloc.PYTHON313 ref: 00007FFD93C08A18

Part of subcall function 00007FFD93C012D0: GetModuleHandleW.KERNEL32 ref: 00007FFD93C012E6
Part of subcall function 00007FFD93C012D0: GetProcAddress.KERNEL32 ref: 00007FFD93C012FB

GetProcAddress.KERNEL32 ref: 00007FFD93C08EEE
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFD93C0A3FB
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C0A411
_Py_Dealloc.PYTHON313 ref: 00007FFD93C0A425
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFD93C0A432
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C0A448
_Py_Dealloc.PYTHON313 ref: 00007FFD93C0A45C
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFD93C0A469
PyDict_SetItemString.PYTHON313 ref: 00007FFD93C0A47F
_Py_Dealloc.PYTHON313 ref: 00007FFD93C0A493

Strings

internal_error, xrefs: 00007FFD93C08D0B
VT_VARIANT, xrefs: 00007FFD93C09DD4
DISPID_NEWENUM, xrefs: 00007FFD93C091FE
REGCLS_SUSPENDED, xrefs: 00007FFD93C09645
Empty, xrefs: 00007FFD93C08BCA
URL_MK_UNIFORM, xrefs: 00007FFD93C0A17F
MKSYS_POINTERMONIKER, xrefs: 00007FFD93C094BF
VT_INT, xrefs: 00007FFD93C09E91
RPC_C_AUTHZ_NAME, xrefs: 00007FFD93C09885
VT_STORED_OBJECT, xrefs: 00007FFD93C09FE1
CoGetObjectContext, xrefs: 00007FFD93C08E5D
TKIND_DISPATCH, xrefs: 00007FFD93C09C21
DESCKIND_FUNCDESC, xrefs: 00007FFD93C0A34A
INVOKE_FUNC, xrefs: 00007FFD93C095B5
VT_CARRAY, xrefs: 00007FFD93C09F0F
fdexPropCannotGet, xrefs: 00007FFD93C0A239
RPC_C_AUTHN_MQ, xrefs: 00007FFD93C09849
RPC_C_AUTHN_GSS_KERBEROS, xrefs: 00007FFD93C0980A
RPC_C_AUTHN_WINNT, xrefs: 00007FFD93C097E0
RPC_C_AUTHN_LEVEL_NONE, xrefs: 00007FFD93C09696
VT_ILLEGALMASKED, xrefs: 00007FFD93C0A0B3
PARAMFLAG_NONE, xrefs: 00007FFD93C094E6
RPC_C_IMP_LEVEL_DEFAULT, xrefs: 00007FFD93C09711
CLSCTX_REMOTE_SERVER, xrefs: 00007FFD93C08FA6
DISPID_COLLECT, xrefs: 00007FFD93C091AD
fdexPropCanPutRef, xrefs: 00007FFD93C0A278
RPC_C_IMP_LEVEL_ANONYMOUS, xrefs: 00007FFD93C09726
fdexPropCanSourceEvents, xrefs: 00007FFD93C0A320
FUNC_VIRTUAL, xrefs: 00007FFD93C0934B
DVASPECT_ICON, xrefs: 00007FFD93C09105
IDLFLAG_FLCID, xrefs: 00007FFD93C0942F
MSHLFLAGS_NORMAL, xrefs: 00007FFD93C0A12B
INVOKE_PROPERTYGET, xrefs: 00007FFD93C095CA
fdexPropCanPut, xrefs: 00007FFD93C0A24E
STREAM_SEEK_SET, xrefs: 00007FFD93C09576
MKSYS_ITEMMONIKER, xrefs: 00007FFD93C094AA
VT_CF, xrefs: 00007FFD93C0A00B
IDLFLAG_FRETVAL, xrefs: 00007FFD93C09444
DVASPECT_DOCPRINT, xrefs: 00007FFD93C0911A
DISPATCH_PROPERTYGET, xrefs: 00007FFD93C0912F
EXTCONN_STRONG, xrefs: 00007FFD93C09267
FUNC_DISPATCH, xrefs: 00007FFD93C0939F
CoGetCancelObject, xrefs: 00007FFD93C08E74
VT_STORAGE, xrefs: 00007FFD93C09FB7
TYPEFLAG_FOLEAUTOMATION, xrefs: 00007FFD93C09B52
TYMED_ISTORAGE, xrefs: 00007FFD93C09075
ole_error, xrefs: 00007FFD93C08CA4
DISPATCH_PROPERTYPUTREF, xrefs: 00007FFD93C09159
FUNCFLAG_FBINDABLE, xrefs: 00007FFD93C092D0
TYPEFLAG_FHIDDEN, xrefs: 00007FFD93C09AFE
EOAC_NO_CUSTOM_MARSHAL, xrefs: 00007FFD93C099E7
FMTID_SummaryInformation, xrefs: 00007FFD93C0A438
FUNC_PUREVIRTUAL, xrefs: 00007FFD93C09360
TYPEFLAG_FRESTRICTED, xrefs: 00007FFD93C09B67
dcom, xrefs: 00007FFD93C0A3E5
FUNC_STATIC, xrefs: 00007FFD93C0938A
VT_PTR, xrefs: 00007FFD93C09EE5
TYMED_HGLOBAL, xrefs: 00007FFD93C09036
fdexNameEnsure, xrefs: 00007FFD93C0A1E5
MSHLFLAGS_TABLESTRONG, xrefs: 00007FFD93C0A140
TypeIIDs, xrefs: 00007FFD93C08B04
MKSYS_GENERICCOMPOSITE, xrefs: 00007FFD93C0946B
RPC_C_IMP_LEVEL_IMPERSONATE, xrefs: 00007FFD93C09750
VT_TYPEMASK, xrefs: 00007FFD93C0A0C8
ACTIVEOBJECT_WEAK, xrefs: 00007FFD93C08F13
STREAM_SEEK_CUR, xrefs: 00007FFD93C0958B
MKSYS_FILEMONIKER, xrefs: 00007FFD93C09480
ROTFLAGS_ALLOWANYCLIENT, xrefs: 00007FFD93C0966F
FUNCFLAG_FUSESGETLASTERROR, xrefs: 00007FFD93C09339
VT_HRESULT, xrefs: 00007FFD93C09ED0
VT_BSTR, xrefs: 00007FFD93C09D80
TYPEFLAG_FNONEXTENSIBLE, xrefs: 00007FFD93C09B3D
TYPEFLAG_FDISPATCHABLE, xrefs: 00007FFD93C09BA6
RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, xrefs: 00007FFD93C096EA
VT_R4, xrefs: 00007FFD93C09D2C
TYPEFLAG_FREVERSEBIND, xrefs: 00007FFD93C09BBB
IMPLTYPEFLAG_FRESTRICTED, xrefs: 00007FFD93C093DE
fdexPropCanConstruct, xrefs: 00007FFD93C0A2F6
DVASPECT_CONTENT, xrefs: 00007FFD93C090DB
TYPEFLAG_FDUAL, xrefs: 00007FFD93C09B28
VT_BYREF, xrefs: 00007FFD93C0A074
CLSCTX_INPROC, xrefs: 00007FFD93C08F3D
VT_STREAM, xrefs: 00007FFD93C09FA2
RPC_C_AUTHN_DCE_PUBLIC, xrefs: 00007FFD93C097A1
ole32.dll, xrefs: 00007FFD93C08E38
VT_LPWSTR, xrefs: 00007FFD93C09F4E
INVOKE_PROPERTYPUT, xrefs: 00007FFD93C095DF
_univgw, xrefs: 00007FFD93C08E21
EOAC_APPID, xrefs: 00007FFD93C09915
RPC_C_AUTHZ_DCE, xrefs: 00007FFD93C0989A
fdexNameCaseInsensitive, xrefs: 00007FFD93C0A20F
VT_FILETIME, xrefs: 00007FFD93C09F78
EOAC_DEFAULT, xrefs: 00007FFD93C099BD
EOAC_DISABLE_AAA, xrefs: 00007FFD93C099D2
EOAC_STATIC_CLOAKING, xrefs: 00007FFD93C0993F
TYPEFLAG_FCANCREATE, xrefs: 00007FFD93C09ABF
VAR_CONST, xrefs: 00007FFD93C09CB1
VT_UNKNOWN, xrefs: 00007FFD93C09DE9
RPC_C_IMP_LEVEL_DELEGATE, xrefs: 00007FFD93C09765
MSHCTX_DIFFERENTMACHINE, xrefs: 00007FFD93C0A104
fdexPropCannotCall, xrefs: 00007FFD93C0A2E1
InterfaceNames, xrefs: 00007FFD93C08B32
EOAC_DYNAMIC_CLOAKING, xrefs: 00007FFD93C09954
FMTID_DocSummaryInformation, xrefs: 00007FFD93C0A401
DISPID_PROPERTYPUT, xrefs: 00007FFD93C091E9
TYMED_FILE, xrefs: 00007FFD93C0904B
VT_UI2, xrefs: 00007FFD93C09E3D
EOAC_DYNAMIC, xrefs: 00007FFD93C0992A
SYS_WIN32, xrefs: 00007FFD93C09A80
FUNCFLAG_FSOURCE, xrefs: 00007FFD93C092BB
TKIND_ALIAS, xrefs: 00007FFD93C09C4B
PARAMFLAG_FOPT, xrefs: 00007FFD93C0954F
STDOLE_MINORVERNUM, xrefs: 00007FFD93C09A0E
CLSCTX_LOCAL_SERVER, xrefs: 00007FFD93C08F91
CLSCTX_INPROC_HANDLER, xrefs: 00007FFD93C08F7C
RPC_C_AUTHN_NONE, xrefs: 00007FFD93C09777
RPC_C_AUTHN_DPA, xrefs: 00007FFD93C09834
TKIND_INTERFACE, xrefs: 00007FFD93C09C0C
TKIND_MODULE, xrefs: 00007FFD93C09BF7
VT_ERROR, xrefs: 00007FFD93C09DAA
ArgNotFound, xrefs: 00007FFD93C08C32
error, xrefs: 00007FFD93C08CBF
RPC_C_AUTHN_MSN, xrefs: 00007FFD93C0981F
com_error, xrefs: 00007FFD93C08CDE
CLSCTX_SERVER, xrefs: 00007FFD93C08F52, 00007FFD93C0A3AB, 00007FFD93C0A3D3
FUNCFLAG_FREQUESTEDIT, xrefs: 00007FFD93C092E5
DISPATCH_PROPERTYPUT, xrefs: 00007FFD93C09144
fdexPropNoSideEffects, xrefs: 00007FFD93C0A2A2
VT_R8, xrefs: 00007FFD93C09D41
VT_ARRAY, xrefs: 00007FFD93C0A05F
VAR_DISPATCH, xrefs: 00007FFD93C09CC6
TYPEFLAG_FREPLACEABLE, xrefs: 00007FFD93C09B91
STDOLE_LCID, xrefs: 00007FFD93C09A20
EOAC_REQUIRE_FULLSIC, xrefs: 00007FFD93C09993
urlmon.dll, xrefs: 00007FFD93C08EC0, 00007FFD93C08ED2
FUNCFLAG_FHIDDEN, xrefs: 00007FFD93C09324
VT_I4, xrefs: 00007FFD93C09D17
RPC_C_AUTHN_GSS_NEGOTIATE, xrefs: 00007FFD93C097CB
CoInitializeSecurity, xrefs: 00007FFD93C08EA2
fdexPropCanCall, xrefs: 00007FFD93C0A2CC
MKSYS_NONE, xrefs: 00007FFD93C09456
TKIND_UNION, xrefs: 00007FFD93C09C60
fdexPropDynamicType, xrefs: 00007FFD93C0A2B7
MKSYS_ANTIMONIKER, xrefs: 00007FFD93C09495
VT_STREAMED_OBJECT, xrefs: 00007FFD93C09FCC
IDLFLAG_FIN, xrefs: 00007FFD93C09405
MSHCTX_NOSHAREDMEM, xrefs: 00007FFD93C0A0EF
frozen, xrefs: 00007FFD93C0A375
TYPEFLAG_FAPPOBJECT, xrefs: 00007FFD93C09AAA
RPC_C_AUTHN_DEFAULT, xrefs: 00007FFD93C0985E
DISPID_THIS, xrefs: 00007FFD93C09252
EOAC_NONE, xrefs: 00007FFD93C098C1
DISPID_EVALUATE, xrefs: 00007FFD93C09213
TYPEFLAG_FCONTROL, xrefs: 00007FFD93C09B13
REGCLS_SINGLEUSE, xrefs: 00007FFD93C09606
Missing, xrefs: 00007FFD93C08BFE
VT_USERDEFINED, xrefs: 00007FFD93C09F24
INVOKE_PROPERTYPUTREF, xrefs: 00007FFD93C095F4
fdexNameImplicit, xrefs: 00007FFD93C0A1FA
VT_VECTOR, xrefs: 00007FFD93C0A04A
VT_EMPTY, xrefs: 00007FFD93C09CD8
STDOLE_MAJORVERNUM, xrefs: 00007FFD93C099FC
FUNCFLAG_FRESTRICTED, xrefs: 00007FFD93C092A6
COINIT_MULTITHREADED, xrefs: 00007FFD93C08FCD
IDLFLAG_FOUT, xrefs: 00007FFD93C0941A
TYMED_ISTREAM, xrefs: 00007FFD93C09060
fdexPropCannotPutRef, xrefs: 00007FFD93C0A28D
VT_RECORD, xrefs: 00007FFD93C09F63
SYS_MAC, xrefs: 00007FFD93C09A95
VT_BOOL, xrefs: 00007FFD93C09DBF
Nothing, xrefs: 00007FFD93C08C66
STDOLE2_LCID, xrefs: 00007FFD93C09A59
fdexPropCanGet, xrefs: 00007FFD93C0A224
RPC_C_IMP_LEVEL_IDENTIFY, xrefs: 00007FFD93C0973B
RPC_C_AUTHN_LEVEL_PKT_PRIVACY, xrefs: 00007FFD93C096FF
IDLFLAG_NONE, xrefs: 00007FFD93C093F0
VAR_STATIC, xrefs: 00007FFD93C09C9C
fdexPropCannotConstruct, xrefs: 00007FFD93C0A30B
DATADIR_SET, xrefs: 00007FFD93C09021
CoWaitForMultipleHandles, xrefs: 00007FFD93C08E4D
EXTCONN_CALLABLE, xrefs: 00007FFD93C09291
STDOLE2_MINORVERNUM, xrefs: 00007FFD93C09A47
VT_VOID, xrefs: 00007FFD93C09EBB
TYPEFLAG_FPREDECLID, xrefs: 00007FFD93C09AE9
pythoncom.internal_error, xrefs: 00007FFD93C08CFC
RPC_C_AUTHN_DCE_PRIVATE, xrefs: 00007FFD93C0978C
PARAMFLAG_FOUT, xrefs: 00007FFD93C09510
DISPID_UNKNOWN, xrefs: 00007FFD93C091D4, 00007FFD93C0923D
COINIT_DISABLE_OLE1DDE, xrefs: 00007FFD93C08FE2
FUNCFLAG_FDEFAULTBIND, xrefs: 00007FFD93C0930F
MSHLFLAGS_NOPING, xrefs: 00007FFD93C0A16A
RPC_C_AUTHN_LEVEL_DEFAULT, xrefs: 00007FFD93C09681
TYMED_MFPICT, xrefs: 00007FFD93C0909F
DVASPECT_THUMBNAIL, xrefs: 00007FFD93C090F0
EXTCONN_WEAK, xrefs: 00007FFD93C0927C
can't define ole_error, xrefs: 00007FFD93C08C8C
PARAMFLAG_FIN, xrefs: 00007FFD93C094FB
VT_CY, xrefs: 00007FFD93C09D56
TYPEFLAG_FLICENSED, xrefs: 00007FFD93C09AD4
DISPID_VALUE, xrefs: 00007FFD93C091BF
DATADIR_GET, xrefs: 00007FFD93C0900C
PARAMFLAG_FLCID, xrefs: 00007FFD93C09525
RPC_C_AUTHN_LEVEL_CONNECT, xrefs: 00007FFD93C096AB
VT_NULL, xrefs: 00007FFD93C09CED
PARAMFLAG_FRETVAL, xrefs: 00007FFD93C0953A
IMPLTYPEFLAG_FDEFAULT, xrefs: 00007FFD93C093B4
CLSCTX_ALL, xrefs: 00007FFD93C08F28, 00007FFD93C0A38C
fdexPropCannotPut, xrefs: 00007FFD93C0A263
SYS_WIN16, xrefs: 00007FFD93C09A6B
RPC_C_AUTHZ_NONE, xrefs: 00007FFD93C09870
VT_BSTR_BLOB, xrefs: 00007FFD93C0A035
VT_UINT, xrefs: 00007FFD93C09EA6
TYPEFLAG_FAGGREGATABLE, xrefs: 00007FFD93C09B7C
VT_BLOB, xrefs: 00007FFD93C09F8D
VT_ILLEGAL, xrefs: 00007FFD93C0A09E
VT_I8, xrefs: 00007FFD93C09E67
COINIT_SPEED_OVER_MEMORY, xrefs: 00007FFD93C08FF7
IMPLTYPEFLAG_FSOURCE, xrefs: 00007FFD93C093C9
DISPID_STARTENUM, xrefs: 00007FFD93C09228
CoCreateInstanceEx, xrefs: 00007FFD93C08E8B
TKIND_COCLASS, xrefs: 00007FFD93C09C36
VT_UI8, xrefs: 00007FFD93C09E7C
VT_UI1, xrefs: 00007FFD93C09E28
MSHLFLAGS_TABLEWEAK, xrefs: 00007FFD93C0A155
TYMED_NULL, xrefs: 00007FFD93C090C6
ServerInterfaces, xrefs: 00007FFD93C08B1B
VT_DATE, xrefs: 00007FFD93C09D6B
VT_DECIMAL, xrefs: 00007FFD93C09DFE
ROTFLAGS_REGISTRATIONKEEPSALIVE, xrefs: 00007FFD93C0965A
coinit_flags, xrefs: 00007FFD93C08A4E
EOAC_SECURE_REFS, xrefs: 00007FFD93C098EB
FUNC_NONVIRTUAL, xrefs: 00007FFD93C09375
VT_UI4, xrefs: 00007FFD93C09E52
DESCKIND_VARDESC, xrefs: 00007FFD93C0A35F
VT_I1, xrefs: 00007FFD93C09E13
ACTIVEOBJECT_STRONG, xrefs: 00007FFD93C08EFE
MKSYS_CLASSMONIKER, xrefs: 00007FFD93C094D4
VT_RESERVED, xrefs: 00007FFD93C0A089
VT_LPSTR, xrefs: 00007FFD93C09F39
CLSCTX_INPROC_SERVER, xrefs: 00007FFD93C08F67
EOAC_ANY_AUTHORITY, xrefs: 00007FFD93C09969
VT_I2, xrefs: 00007FFD93C09D02
fdexPropCannotSourceEvents, xrefs: 00007FFD93C0A335
TYMED_ENHMF, xrefs: 00007FFD93C090B4
TYMED_GDI, xrefs: 00007FFD93C0908A
TKIND_RECORD, xrefs: 00007FFD93C09BE2
DISPATCH_METHOD, xrefs: 00007FFD93C0916E
MSHCTX_INPROC, xrefs: 00007FFD93C0A119
VARFLAG_FREADONLY, xrefs: 00007FFD93C09C75
RPC_C_AUTHZ_DEFAULT, xrefs: 00007FFD93C098AF
DISPID_DESTRUCTOR, xrefs: 00007FFD93C09198
STDOLE2_MAJORVERNUM, xrefs: 00007FFD93C09A35
MSHCTX_LOCAL, xrefs: 00007FFD93C0A0DA
VT_CLSID, xrefs: 00007FFD93C0A020
DISPID_CONSTRUCTOR, xrefs: 00007FFD93C09183
VT_SAFEARRAY, xrefs: 00007FFD93C09EFA
VAR_PERINSTANCE, xrefs: 00007FFD93C09C87
FMTID_UserDefinedProperties, xrefs: 00007FFD93C0A46F
FUNCFLAG_FDISPLAYBIND, xrefs: 00007FFD93C092FA
fdexNameCaseSensitive, xrefs: 00007FFD93C0A1D0
URL_MK_LEGACY, xrefs: 00007FFD93C0A191
RPC_C_AUTHN_DEC_PUBLIC, xrefs: 00007FFD93C097B6
REGCLS_MULTI_SEPARATE, xrefs: 00007FFD93C09630
TKIND_ENUM, xrefs: 00007FFD93C09BCD
COWAIT_ALERTABLE, xrefs: 00007FFD93C0A1BB
VT_BLOB_OBJECT, xrefs: 00007FFD93C09FF6
PARAMFLAG_FHASDEFAULT, xrefs: 00007FFD93C09564
RPC_C_AUTHN_GSS_SCHANNEL, xrefs: 00007FFD93C097F5
REGCLS_MULTIPLEUSE, xrefs: 00007FFD93C0961B
CreateURLMonikerEx, xrefs: 00007FFD93C08EE4
RPC_C_AUTHN_LEVEL_CALL, xrefs: 00007FFD93C096C0
COWAIT_WAITALL, xrefs: 00007FFD93C0A1A6
EOAC_MUTUAL_AUTH, xrefs: 00007FFD93C098D6
VT_DISPATCH, xrefs: 00007FFD93C09D95
EOAC_ACCESS_CONTROL, xrefs: 00007FFD93C09900
STREAM_SEEK_END, xrefs: 00007FFD93C095A0
EOAC_AUTO_IMPERSONATE, xrefs: 00007FFD93C099A8
EOAC_MAKE_FULLSIC, xrefs: 00007FFD93C0997E
COINIT_APARTMENTTHREADED, xrefs: 00007FFD93C08FBB
RPC_C_AUTHN_LEVEL_PKT, xrefs: 00007FFD93C096D5

Memory Dump Source

Source File: 00000002.00000002.3410823626.00007FFD93BF1000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFD93BF0000, based on PE: true

Associated: 00000002.00000002.3410805377.00007FFD93BF0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410893652.00007FFD93C81000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410911924.00007FFD93C8C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410930367.00007FFD93C8D000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410958266.00007FFD93C96000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93bf0000_user.jbxd

Similarity

API ID: Dict_String$Item$ReadyType_$AddressProc$DeallocFrom$D@@@Err_Object_ReferenceU_object@@$HandleModuleModule_$Create2LongLong_$ClearDictEnsure@@ExceptionGlobals_LibraryLoadMaskObjectOccurredSys_Unsigned
String ID: ACTIVEOBJECT_STRONG$ACTIVEOBJECT_WEAK$ArgNotFound$CLSCTX_ALL$CLSCTX_INPROC$CLSCTX_INPROC_HANDLER$CLSCTX_INPROC_SERVER$CLSCTX_LOCAL_SERVER$CLSCTX_REMOTE_SERVER$CLSCTX_SERVER$COINIT_APARTMENTTHREADED$COINIT_DISABLE_OLE1DDE$COINIT_MULTITHREADED$COINIT_SPEED_OVER_MEMORY$COWAIT_ALERTABLE$COWAIT_WAITALL$CoCreateInstanceEx$CoGetCancelObject$CoGetObjectContext$CoInitializeSecurity$CoWaitForMultipleHandles$CreateURLMonikerEx$DATADIR_GET$DATADIR_SET$DESCKIND_FUNCDESC$DESCKIND_VARDESC$DISPATCH_METHOD$DISPATCH_PROPERTYGET$DISPATCH_PROPERTYPUT$DISPATCH_PROPERTYPUTREF$DISPID_COLLECT$DISPID_CONSTRUCTOR$DISPID_DESTRUCTOR$DISPID_EVALUATE$DISPID_NEWENUM$DISPID_PROPERTYPUT$DISPID_STARTENUM$DISPID_THIS$DISPID_UNKNOWN$DISPID_VALUE$DVASPECT_CONTENT$DVASPECT_DOCPRINT$DVASPECT_ICON$DVASPECT_THUMBNAIL$EOAC_ACCESS_CONTROL$EOAC_ANY_AUTHORITY$EOAC_APPID$EOAC_AUTO_IMPERSONATE$EOAC_DEFAULT$EOAC_DISABLE_AAA$EOAC_DYNAMIC$EOAC_DYNAMIC_CLOAKING$EOAC_MAKE_FULLSIC$EOAC_MUTUAL_AUTH$EOAC_NONE$EOAC_NO_CUSTOM_MARSHAL$EOAC_REQUIRE_FULLSIC$EOAC_SECURE_REFS$EOAC_STATIC_CLOAKING$EXTCONN_CALLABLE$EXTCONN_STRONG$EXTCONN_WEAK$Empty$FMTID_DocSummaryInformation$FMTID_SummaryInformation$FMTID_UserDefinedProperties$FUNCFLAG_FBINDABLE$FUNCFLAG_FDEFAULTBIND$FUNCFLAG_FDISPLAYBIND$FUNCFLAG_FHIDDEN$FUNCFLAG_FREQUESTEDIT$FUNCFLAG_FRESTRICTED$FUNCFLAG_FSOURCE$FUNCFLAG_FUSESGETLASTERROR$FUNC_DISPATCH$FUNC_NONVIRTUAL$FUNC_PUREVIRTUAL$FUNC_STATIC$FUNC_VIRTUAL$IDLFLAG_FIN$IDLFLAG_FLCID$IDLFLAG_FOUT$IDLFLAG_FRETVAL$IDLFLAG_NONE$IMPLTYPEFLAG_FDEFAULT$IMPLTYPEFLAG_FRESTRICTED$IMPLTYPEFLAG_FSOURCE$INVOKE_FUNC$INVOKE_PROPERTYGET$INVOKE_PROPERTYPUT$INVOKE_PROPERTYPUTREF$InterfaceNames$MKSYS_ANTIMONIKER$MKSYS_CLASSMONIKER$MKSYS_FILEMONIKER$MKSYS_GENERICCOMPOSITE$MKSYS_ITEMMONIKER$MKSYS_NONE$MKSYS_POINTERMONIKER$MSHCTX_DIFFERENTMACHINE$MSHCTX_INPROC$MSHCTX_LOCAL$MSHCTX_NOSHAREDMEM$MSHLFLAGS_NOPING$MSHLFLAGS_NORMAL$MSHLFLAGS_TABLESTRONG$MSHLFLAGS_TABLEWEAK$Missing$Nothing$PARAMFLAG_FHASDEFAULT$PARAMFLAG_FIN$PARAMFLAG_FLCID$PARAMFLAG_FOPT$PARAMFLAG_FOUT$PARAMFLAG_FRETVAL$PARAMFLAG_NONE$REGCLS_MULTIPLEUSE$REGCLS_MULTI_SEPARATE$REGCLS_SINGLEUSE$REGCLS_SUSPENDED$ROTFLAGS_ALLOWANYCLIENT$ROTFLAGS_REGISTRATIONKEEPSALIVE$RPC_C_AUTHN_DCE_PRIVATE$RPC_C_AUTHN_DCE_PUBLIC$RPC_C_AUTHN_DEC_PUBLIC$RPC_C_AUTHN_DEFAULT$RPC_C_AUTHN_DPA$RPC_C_AUTHN_GSS_KERBEROS$RPC_C_AUTHN_GSS_NEGOTIATE$RPC_C_AUTHN_GSS_SCHANNEL$RPC_C_AUTHN_LEVEL_CALL$RPC_C_AUTHN_LEVEL_CONNECT$RPC_C_AUTHN_LEVEL_DEFAULT$RPC_C_AUTHN_LEVEL_NONE$RPC_C_AUTHN_LEVEL_PKT$RPC_C_AUTHN_LEVEL_PKT_INTEGRITY$RPC_C_AUTHN_LEVEL_PKT_PRIVACY$RPC_C_AUTHN_MQ$RPC_C_AUTHN_MSN$RPC_C_AUTHN_NONE$RPC_C_AUTHN_WINNT$RPC_C_AUTHZ_DCE$RPC_C_AUTHZ_DEFAULT$RPC_C_AUTHZ_NAME$RPC_C_AUTHZ_NONE$RPC_C_IMP_LEVEL_ANONYMOUS$RPC_C_IMP_LEVEL_DEFAULT$RPC_C_IMP_LEVEL_DELEGATE$RPC_C_IMP_LEVEL_IDENTIFY$RPC_C_IMP_LEVEL_IMPERSONATE$STDOLE2_LCID$STDOLE2_MAJORVERNUM$STDOLE2_MINORVERNUM$STDOLE_LCID$STDOLE_MAJORVERNUM$STDOLE_MINORVERNUM$STREAM_SEEK_CUR$STREAM_SEEK_END$STREAM_SEEK_SET$SYS_MAC$SYS_WIN16$SYS_WIN32$ServerInterfaces$TKIND_ALIAS$TKIND_COCLASS$TKIND_DISPATCH$TKIND_ENUM$TKIND_INTERFACE$TKIND_MODULE$TKIND_RECORD$TKIND_UNION$TYMED_ENHMF$TYMED_FILE$TYMED_GDI$TYMED_HGLOBAL$TYMED_ISTORAGE$TYMED_ISTREAM$TYMED_MFPICT$TYMED_NULL$TYPEFLAG_FAGGREGATABLE$TYPEFLAG_FAPPOBJECT$TYPEFLAG_FCANCREATE$TYPEFLAG_FCONTROL$TYPEFLAG_FDISPATCHABLE$TYPEFLAG_FDUAL$TYPEFLAG_FHIDDEN$TYPEFLAG_FLICENSED$TYPEFLAG_FNONEXTENSIBLE$TYPEFLAG_FOLEAUTOMATION$TYPEFLAG_FPREDECLID$TYPEFLAG_FREPLACEABLE$TYPEFLAG_FRESTRICTED$TYPEFLAG_FREVERSEBIND$TypeIIDs$URL_MK_LEGACY$URL_MK_UNIFORM$VARFLAG_FREADONLY$VAR_CONST$VAR_DISPATCH$VAR_PERINSTANCE$VAR_STATIC$VT_ARRAY$VT_BLOB$VT_BLOB_OBJECT$VT_BOOL$VT_BSTR$VT_BSTR_BLOB$VT_BYREF$VT_CARRAY$VT_CF$VT_CLSID$VT_CY$VT_DATE$VT_DECIMAL$VT_DISPATCH$VT_EMPTY$VT_ERROR$VT_FILETIME$VT_HRESULT$VT_I1$VT_I2$VT_I4$VT_I8$VT_ILLEGAL$VT_ILLEGALMASKED$VT_INT$VT_LPSTR$VT_LPWSTR$VT_NULL$VT_PTR$VT_R4$VT_R8$VT_RECORD$VT_RESERVED$VT_SAFEARRAY$VT_STORAGE$VT_STORED_OBJECT$VT_STREAM$VT_STREAMED_OBJECT$VT_TYPEMASK$VT_UI1$VT_UI2$VT_UI4$VT_UI8$VT_UINT$VT_UNKNOWN$VT_USERDEFINED$VT_VARIANT$VT_VECTOR$VT_VOID$_univgw$can't define ole_error$coinit_flags$com_error$dcom$error$fdexNameCaseInsensitive$fdexNameCaseSensitive$fdexNameEnsure$fdexNameImplicit$fdexPropCanCall$fdexPropCanConstruct$fdexPropCanGet$fdexPropCanPut$fdexPropCanPutRef$fdexPropCanSourceEvents$fdexPropCannotCall$fdexPropCannotConstruct$fdexPropCannotGet$fdexPropCannotPut$fdexPropCannotPutRef$fdexPropCannotSourceEvents$fdexPropDynamicType$fdexPropNoSideEffects$frozen$internal_error$ole32.dll$ole_error$pythoncom.internal_error$urlmon.dll
API String ID: 1000972437-3953899047
Opcode ID: 50b178b6dc7987ebe6360e7943940d86408c5d0eb80b93197e5c57d2a6e1887f
Instruction ID: deeb8f721e8af3959aa280defdfd438f93a87f4b0bd387f06fbbb52894b7dbce
Opcode Fuzzy Hash: 50b178b6dc7987ebe6360e7943940d86408c5d0eb80b93197e5c57d2a6e1887f
Instruction Fuzzy Hash: E2D23B54B1DF4280FE34ABD6D6B07BC176AAF46BC0F809431D84D37B929F6EA6058742

Function 00007FFDA35A1A0F Relevance: 144.4, APIs: 74, Strings: 8, Instructions: 858COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFDA35EACE7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35EACFF
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35EAE96
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35EAEAE
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FFDA35EAF96
EVP_CIPHER_get_flags.LIBCRYPTO-3 ref: 00007FFDA35EAF9E
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35EB00C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35EB024
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35EB191
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35EB1A9
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35EB1DA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35EB1F2
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFDA35EB213
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFDA35EB220
CRYPTO_memcmp.LIBCRYPTO-3 ref: 00007FFDA35EB2AA
ERR_set_mark.LIBCRYPTO-3 ref: 00007FFDA35EB2C6
ERR_clear_last_mark.LIBCRYPTO-3 ref: 00007FFDA35EB315
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35EB31F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35EB337
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFDA35EB496
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFDA35EB4B5
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35EBA16
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35EBA2E
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35EBA40
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35EBA4C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35EBA64

Strings

, xrefs: 00007FFDA35EB187
ssl3_get_record, xrefs: 00007FFDA35EACF1, 00007FFDA35EAEA0, 00007FFDA35EB016, 00007FFDA35EB064, 00007FFDA35EB094, 00007FFDA35EB0BC, 00007FFDA35EB0E9, 00007FFDA35EB196, 00007FFDA35EB1DF, 00007FFDA35EB324, 00007FFDA35EB34C, 00007FFDA35EB3B8, 00007FFDA35EB439, 00007FFDA35EB593, 00007FFDA35EB743, 00007FFDA35EB7C2, 00007FFDA35EB7EF, 00007FFDA35EB821, 00007FFDA35EB855, 00007FFDA35EB887, 00007FFDA35EB973, 00007FFDA35EB9AD, 00007FFDA35EBA20, 00007FFDA35EBA51
PUT , xrefs: 00007FFDA35EB943
POST , xrefs: 00007FFDA35EB90B
HEAD , xrefs: 00007FFDA35EB929
CONNE, xrefs: 00007FFDA35EB95A
..\s\ssl\record\ssl3_record.c, xrefs: 00007FFDA35EACF8, 00007FFDA35EAEA7, 00007FFDA35EB01D, 00007FFDA35EB06B, 00007FFDA35EB09B, 00007FFDA35EB0C8, 00007FFDA35EB0F5, 00007FFDA35EB1A2, 00007FFDA35EB1EB, 00007FFDA35EB330, 00007FFDA35EB358, 00007FFDA35EB38F, 00007FFDA35EB3C4, 00007FFDA35EB445, 00007FFDA35EB489, 00007FFDA35EB4AB, 00007FFDA35EB74F, 00007FFDA35EB7CE, 00007FFDA35EB7FB, 00007FFDA35EB828, 00007FFDA35EB861, 00007FFDA35EB88E, 00007FFDA35EB97F, 00007FFDA35EB9B9, 00007FFDA35EBA27, 00007FFDA35EBA5D
GET , xrefs: 00007FFDA35EB8E8

Memory Dump Source

Source File: 00000002.00000002.3413120619.00007FFDA35A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDA35A0000, based on PE: true

Associated: 00000002.00000002.3413103779.00007FFDA35A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413120619.00007FFDA3623000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413218182.00007FFDA364D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3652000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3658000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda35a0000_user.jbxd

Similarity

API ID: R_new$R_set_debug$O_free$D_get_sizeO_memcmpR_clear_last_markR_get_flagsR_set_markX_get0_cipherX_get0_md
String ID: $..\s\ssl\record\ssl3_record.c$CONNE$GET $HEAD $POST $PUT $ssl3_get_record
API String ID: 2283737721-2781224710
Opcode ID: 40243567b0c9e5d0b1d25a9c0806e483eb2da45cb6c3cb4bcf6ca79101e842da
Instruction ID: 764d7565e730c087641b3fe395250c3c464e3cc933ab108d8d2e831dd4d909b7
Opcode Fuzzy Hash: 40243567b0c9e5d0b1d25a9c0806e483eb2da45cb6c3cb4bcf6ca79101e842da
Instruction Fuzzy Hash: B2828C32B0EA8282FB25DB29D4603B92792EF41785F685036DA4D677D7DF3EE5418308

Function 00007FFD93C01330 Relevance: 68.5, APIs: 31, Strings: 8, Instructions: 260
threadcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFD93C0137C
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFD93C01394
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFD93C013AC
PyObject_IsInstance.PYTHON313 ref: 00007FFD93C013DE
PyErr_Occurred.PYTHON313 ref: 00007FFD93C013F3
PyErr_SetString.PYTHON313 ref: 00007FFD93C0140F
PyObject_IsInstance.PYTHON313 ref: 00007FFD93C01556
PyErr_Format.PYTHON313 ref: 00007FFD93C01579
PyErr_SetString.PYTHON313 ref: 00007FFD93C015A2
PyEval_SaveThread.PYTHON313 ref: 00007FFD93C015AC
PyEval_RestoreThread.PYTHON313 ref: 00007FFD93C015CF
_Py_Dealloc.PYTHON313 ref: 00007FFD93C01607
PyEval_SaveThread.PYTHON313 ref: 00007FFD93C0161A
CoCreateInstance.COMBASE ref: 00007FFD93C01641
PyEval_RestoreThread.PYTHON313 ref: 00007FFD93C0165C
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFD93C016AD
PyDict_GetItem.PYTHON313 ref: 00007FFD93C016C5
_Py_Dealloc.PYTHON313 ref: 00007FFD93C016DC
PyErr_Clear.PYTHON313 ref: 00007FFD93C016E7
PyErr_SetString.PYTHON313 ref: 00007FFD93C016FE
PyEval_SaveThread.PYTHON313 ref: 00007FFD93C01704
PyEval_RestoreThread.PYTHON313 ref: 00007FFD93C01719
PyObject_IsSubclass.PYTHON313 ref: 00007FFD93C01731

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFD93C01750
_oleobj_, xrefs: 00007FFD93C014DA
The Python instance can not be converted to a COM object, xrefs: 00007FFD93C014FF
OOiO:CoCreateInstance, xrefs: 00007FFD93C01375
argument is not a COM object (got type=%s), xrefs: 00007FFD93C0144C, 00007FFD93C01564
There is no interface object registered that supports this IID, xrefs: 00007FFD93C016ED
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFD93C0173B
The Python object is NULL and no error occurred, xrefs: 00007FFD93C01405

Memory Dump Source

Source File: 00000002.00000002.3410823626.00007FFD93BF1000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFD93BF0000, based on PE: true

Associated: 00000002.00000002.3410805377.00007FFD93BF0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410893652.00007FFD93C81000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410911924.00007FFD93C8C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410930367.00007FFD93C8D000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410958266.00007FFD93C96000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93bf0000_user.jbxd

Similarity

API ID: Err_Eval_Object_Thread$D@@@InstanceRestoreSaveStringU_object@@$Dealloc$Arg_ClearCreateDict_FormatFromItemOccurredParseSubclassTuple
String ID: OOiO:CoCreateInstance$The Python IID map is invalid - the value is not an interface type object$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$_oleobj_$argument is not a COM object (got type=%s)
API String ID: 490376945-835438780
Opcode ID: e0db31c0a3172582a73f09f7ddf91617fb67f09ea01f749cd19af58f17944bb1
Instruction ID: 67075d230dbe4d379f5a93c09d1e6eb1f0c8e7f3e5409036c6da3ee19b509307
Opcode Fuzzy Hash: e0db31c0a3172582a73f09f7ddf91617fb67f09ea01f749cd19af58f17944bb1
Instruction Fuzzy Hash: B8C1E869B08F8282EE319FE5E86427D63A9FF85B84F455436DA4E67764DF3CE4048340

Function 00007FF715751000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF715753D35
Failed to remove temporary directory: %s, xrefs: 00007FF715753FCF
Failed to start splash screen!, xrefs: 00007FF715753ED4
pyi-disable-windowed-traceback, xrefs: 00007FF715753BB2
pyi-contents-directory, xrefs: 00007FF715753B8D
pyi-runtime-tmpdir, xrefs: 00007FF715753B68
Failed to load splash screen resources!, xrefs: 00007FF715753E85
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF715753E0A
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF715753971
pkg, xrefs: 00007FF7157539BE
VCRUNTIME140.dll, xrefs: 00007FF715753DB1
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF715753C61
_PYI_ARCHIVE_FILE, xrefs: 00007FF7157538D2, 00007FF7157539FF
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF715753EA6
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF715753882, 00007FF7157538AF
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF715753BE8
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF715753B32
Failed to convert DLL search path!, xrefs: 00007FF715753DDC
Py_GIL_DISABLED, xrefs: 00007FF715753AF4
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF715753EBB
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF715753A0B, 00007FF715753CD4, 00007FF715753F6B
_PYI_SPLASH_IPC, xrefs: 00007FF715753A23, 00007FF715753EF5
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF715753A17, 00007FF715753A2F, 00007FF715753A9B
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7157539DE
MEI, xrefs: 00007FF715753933
pyi-python-flag, xrefs: 00007FF715753AD6
Could not create temporary directory!, xrefs: 00007FF715753CBF
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF715753D12

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: d52c1960cc45de78c26c9f57622ace5a14626686e839aa839f1fc42fe00fc1f1
Instruction ID: 58dd2ba80dbce8395e45d855a4c0d074b63ba3ff94bdad1ae7dd072854ad1923
Opcode Fuzzy Hash: d52c1960cc45de78c26c9f57622ace5a14626686e839aa839f1fc42fe00fc1f1
Instruction Fuzzy Hash: 91328161A28E8251FA1DBB24D45A2B9A771AF4CF60FC44436DA5D432F6EF2CE55CC320

Function 00007FF715776964 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF715776698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7157766D9
Part of subcall function 00007FF715776698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF715776757
Part of subcall function 00007FF715776698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7157767A8

CreateFileW.KERNEL32 ref: 00007FF715776A6A
CreateFileW.KERNEL32 ref: 00007FF715776ABA
GetLastError.KERNEL32 ref: 00007FF715776AEA
GetFileType.KERNEL32 ref: 00007FF715776AFF
GetLastError.KERNEL32 ref: 00007FF715776B09
CloseHandle.KERNEL32 ref: 00007FF715776B3C
CloseHandle.KERNEL32 ref: 00007FF715776C9F
CreateFileW.KERNEL32 ref: 00007FF715776CD4
GetLastError.KERNEL32 ref: 00007FF715776CE3

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: 9e28f6dbed1c0a98924333fb5d748b672a487cfc5098a4c8f175e3712142711a
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 68C1D036B28E4285EB18EF69D0966AC7761F749FA8B910235DA1E573A8DF38D019C310

Function 00007FF715759280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF7157592B3
FindClose.KERNEL32 ref: 00007FF7157592C2

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 458ad79b6f898083fe1769401eae53a4fded3e0317c57a0229e07f52979f8c2b
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: AFF0CD22A28B4186F7649B50B48E776B360EB49B38F840335DA6D01AE4DF3CD04CC700

Function 00007FFD9F3CEFE0 Relevance: 306.6, APIs: 93, Strings: 82, Instructions: 391
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?PyWinGlobals_Ensure@@YAHXZ.PYWINTYPES313 ref: 00007FFD9F3CEFEA
PyModule_Create2.PYTHON313 ref: 00007FFD9F3CF005
PyModule_GetDict.PYTHON313 ref: 00007FFD9F3CF01A
PyDict_SetItemString.PYTHON313 ref: 00007FFD9F3CF040
PyLong_FromLong.PYTHON313 ref: 00007FFD9F3CF04B
PyDict_SetItemString.PYTHON313 ref: 00007FFD9F3CF05E
PyLong_FromLong.PYTHON313 ref: 00007FFD9F3CF069
PyDict_SetItemString.PYTHON313 ref: 00007FFD9F3CF07C
PyLong_FromLong.PYTHON313 ref: 00007FFD9F3CF087
PyDict_SetItemString.PYTHON313 ref: 00007FFD9F3CF09A
PyType_Ready.PYTHON313 ref: 00007FFD9F3CF0A7
PyDict_SetItemString.PYTHON313 ref: 00007FFD9F3CF0C7
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF0E3
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF0F9
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF10F
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF125
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF13B
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF151
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF167
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF17D
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF193
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF1A9
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF1BF
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF1D5
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF1EB
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF201
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF217
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF22D
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF243
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF259
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF26F
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF285
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF29B
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF2AE
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF2C4
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF2DA
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF2F0
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF306
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF31C
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF32F
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF345
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF35B
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF371
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF387
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF39D
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF3B3
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF3C9
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF3DF
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF3F5
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF40B
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF421
PyModule_AddIntConstant.PYTHON313 ref: 00007FFD9F3CF437
GetModuleHandleW.KERNEL32 ref: 00007FFD9F3CF444
LoadLibraryExW.KERNEL32 ref: 00007FFD9F3CF459
GetProcAddressForCaller.KERNELBASE ref: 00007FFD9F3CF471
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF488
GetModuleHandleW.KERNEL32 ref: 00007FFD9F3CF49C
LoadLibraryW.KERNEL32 ref: 00007FFD9F3CF4B1
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF4CD
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF4E4
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF4F4
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF50B
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF522
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF539
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF550
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF567
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF57E
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF595
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF5AC
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF5C3
GetModuleHandleW.KERNEL32 ref: 00007FFD9F3CF5D7
LoadLibraryW.KERNEL32 ref: 00007FFD9F3CF5EC
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF608
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF61F
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF636
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF64D
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF664
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF67B
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF692
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF6A9
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF6C0
GetModuleHandleW.KERNEL32 ref: 00007FFD9F3CF6D4
LoadLibraryW.KERNEL32 ref: 00007FFD9F3CF6E9
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF705
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF71C
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF733
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF74A
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF761
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF778
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF78F
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF7A6
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF7BD
GetProcAddress.KERNEL32 ref: 00007FFD9F3CF7D4

Strings

VOS_OS232, xrefs: 00007FFD9F3CF265
VOS_UNKNOWN, xrefs: 00007FFD9F3CF2A4
GetComputerObjectNameW, xrefs: 00007FFD9F3CF477
GetNativeSystemInfo, xrefs: 00007FFD9F3CF5B2
VS_FF_INFOINFERRED, xrefs: 00007FFD9F3CF3D5
RegCopyTreeW, xrefs: 00007FFD9F3CF77E
SetDllDirectoryW, xrefs: 00007FFD9F3CF584
error, xrefs: 00007FFD9F3CF033
VFT_FONT, xrefs: 00007FFD9F3CF37D
RegDeleteKeyExW, xrefs: 00007FFD9F3CF750
NameServicePrincipal, xrefs: 00007FFD9F3CF189
GlobalMemoryStatusEx, xrefs: 00007FFD9F3CF528
VOS_DOS, xrefs: 00007FFD9F3CF1F7
NameUnknown, xrefs: 00007FFD9F3CF0D9
RegRestoreKeyW, xrefs: 00007FFD9F3CF6FB
GetDllDirectoryW, xrefs: 00007FFD9F3CF56D
REG_NOTIFY_CHANGE_SECURITY, xrefs: 00007FFD9F3CF1E1
VOS__PM32, xrefs: 00007FFD9F3CF291
VFT_UNKNOWN, xrefs: 00007FFD9F3CF325
GetComputerNameExW, xrefs: 00007FFD9F3CF4C3
RegDeleteKeyTransactedW, xrefs: 00007FFD9F3CF767
GetLongPathNameW, xrefs: 00007FFD9F3CF4EA
NameCanonicalEx, xrefs: 00007FFD9F3CF173
RegSaveKeyExW, xrefs: 00007FFD9F3CF70B
MonitorFromPoint, xrefs: 00007FFD9F3CF66A
VOS_NT_WINDOWS32, xrefs: 00007FFD9F3CF2E6
RegOpenKeyTransactedW, xrefs: 00007FFD9F3CF739
REG_NOTIFY_CHANGE_LAST_SET, xrefs: 00007FFD9F3CF1CB
NameUniqueId, xrefs: 00007FFD9F3CF131
GetLastInputInfo, xrefs: 00007FFD9F3CF6AF
VS_FF_DEBUG, xrefs: 00007FFD9F3CF3BF
EnumDisplayMonitors, xrefs: 00007FFD9F3CF5FE
kernel32.dll, xrefs: 00007FFD9F3CF495, 00007FFD9F3CF4AA
VFT_VXD, xrefs: 00007FFD9F3CF393
PyDISPLAY_DEVICEType, xrefs: 00007FFD9F3CF0C0
VFT_DLL, xrefs: 00007FFD9F3CF351
NameSamCompatible, xrefs: 00007FFD9F3CF105
GetLongPathNameA, xrefs: 00007FFD9F3CF4D3
VOS__WINDOWS32, xrefs: 00007FFD9F3CF239
ChangeDisplaySettingsExW, xrefs: 00007FFD9F3CF625
VS_FF_PRIVATEBUILD, xrefs: 00007FFD9F3CF417
GetMonitorInfoW, xrefs: 00007FFD9F3CF681
RegOpenCurrentUser, xrefs: 00007FFD9F3CF7AC
RegCreateKeyTransactedW, xrefs: 00007FFD9F3CF722
REG_NOTIFY_CHANGE_NAME, xrefs: 00007FFD9F3CF19F
NameFullyQualifiedDN, xrefs: 00007FFD9F3CF0EF
VFT_DRV, xrefs: 00007FFD9F3CF367
SetSystemPowerState, xrefs: 00007FFD9F3CF59B
NameCanonical, xrefs: 00007FFD9F3CF147
VOS__WINDOWS16, xrefs: 00007FFD9F3CF223
EnumDisplayDevicesW, xrefs: 00007FFD9F3CF60E
SetHandleInformation, xrefs: 00007FFD9F3CF511
SetSystemFileCacheSize, xrefs: 00007FFD9F3CF556
VOS_OS216, xrefs: 00007FFD9F3CF24F
Advapi32.dll, xrefs: 00007FFD9F3CF6CD, 00007FFD9F3CF6E2
VOS_NT, xrefs: 00007FFD9F3CF20D
user32.dll, xrefs: 00007FFD9F3CF5D0, 00007FFD9F3CF5E5
VOS_DOS_WINDOWS32, xrefs: 00007FFD9F3CF2D0
RegDeleteTreeW, xrefs: 00007FFD9F3CF795
secur32.dll, xrefs: 00007FFD9F3CF43D, 00007FFD9F3CF452
RegOverridePredefKey, xrefs: 00007FFD9F3CF7C3
VS_FF_SPECIALBUILD, xrefs: 00007FFD9F3CF42D
VFT_APP, xrefs: 00007FFD9F3CF33B
STD_INPUT_HANDLE, xrefs: 00007FFD9F3CF051
VFT_STATIC_LIB, xrefs: 00007FFD9F3CF3A9
VOS_OS216_PM16, xrefs: 00007FFD9F3CF2FC
VOS_DOS_WINDOWS16, xrefs: 00007FFD9F3CF2BA
GetSystemFileCacheSize, xrefs: 00007FFD9F3CF53F
STD_ERROR_HANDLE, xrefs: 00007FFD9F3CF08D
VS_FF_PATCHED, xrefs: 00007FFD9F3CF3EB
MonitorFromRect, xrefs: 00007FFD9F3CF653
VOS_OS232_PM32, xrefs: 00007FFD9F3CF312
REG_NOTIFY_CHANGE_ATTRIBUTES, xrefs: 00007FFD9F3CF1B5
VS_FF_PRERELEASE, xrefs: 00007FFD9F3CF401
STD_OUTPUT_HANDLE, xrefs: 00007FFD9F3CF06F
GetHandleInformation, xrefs: 00007FFD9F3CF4FA
EnumDisplaySettingsExW, xrefs: 00007FFD9F3CF698
GetUserNameExW, xrefs: 00007FFD9F3CF467
NameDisplay, xrefs: 00007FFD9F3CF11B
MonitorFromWindow, xrefs: 00007FFD9F3CF63C
VOS__PM16, xrefs: 00007FFD9F3CF27B
NameUserPrincipal, xrefs: 00007FFD9F3CF15D

Memory Dump Source

Source File: 00000002.00000002.3412833876.00007FFD9F3C1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD9F3C0000, based on PE: true

Associated: 00000002.00000002.3412815017.00007FFD9F3C0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3412855086.00007FFD9F3D3000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3412872455.00007FFD9F3DE000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3412888104.00007FFD9F3E1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9f3c0000_user.jbxd

Similarity

API ID: Module_$Constant$AddressProc$Dict_ItemString$HandleLibraryLoadModule$FromLongLong_$CallerCreate2DictEnsure@@Globals_ReadyType_
String ID: Advapi32.dll$ChangeDisplaySettingsExW$EnumDisplayDevicesW$EnumDisplayMonitors$EnumDisplaySettingsExW$GetComputerNameExW$GetComputerObjectNameW$GetDllDirectoryW$GetHandleInformation$GetLastInputInfo$GetLongPathNameA$GetLongPathNameW$GetMonitorInfoW$GetNativeSystemInfo$GetSystemFileCacheSize$GetUserNameExW$GlobalMemoryStatusEx$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$NameCanonical$NameCanonicalEx$NameDisplay$NameFullyQualifiedDN$NameSamCompatible$NameServicePrincipal$NameUniqueId$NameUnknown$NameUserPrincipal$PyDISPLAY_DEVICEType$REG_NOTIFY_CHANGE_ATTRIBUTES$REG_NOTIFY_CHANGE_LAST_SET$REG_NOTIFY_CHANGE_NAME$REG_NOTIFY_CHANGE_SECURITY$RegCopyTreeW$RegCreateKeyTransactedW$RegDeleteKeyExW$RegDeleteKeyTransactedW$RegDeleteTreeW$RegOpenCurrentUser$RegOpenKeyTransactedW$RegOverridePredefKey$RegRestoreKeyW$RegSaveKeyExW$STD_ERROR_HANDLE$STD_INPUT_HANDLE$STD_OUTPUT_HANDLE$SetDllDirectoryW$SetHandleInformation$SetSystemFileCacheSize$SetSystemPowerState$VFT_APP$VFT_DLL$VFT_DRV$VFT_FONT$VFT_STATIC_LIB$VFT_UNKNOWN$VFT_VXD$VOS_DOS$VOS_DOS_WINDOWS16$VOS_DOS_WINDOWS32$VOS_NT$VOS_NT_WINDOWS32$VOS_OS216$VOS_OS216_PM16$VOS_OS232$VOS_OS232_PM32$VOS_UNKNOWN$VOS__PM16$VOS__PM32$VOS__WINDOWS16$VOS__WINDOWS32$VS_FF_DEBUG$VS_FF_INFOINFERRED$VS_FF_PATCHED$VS_FF_PRERELEASE$VS_FF_PRIVATEBUILD$VS_FF_SPECIALBUILD$error$kernel32.dll$secur32.dll$user32.dll
API String ID: 1655756704-685172649
Opcode ID: a7487b2dee23a116e8347555e7407e29fd53b6a731b5dd2c7359c43d764bff69
Instruction ID: 18ad3fa4c4cdf3a06251815b2829a54982cf765d1edec11a2643252e632889dc
Opcode Fuzzy Hash: a7487b2dee23a116e8347555e7407e29fd53b6a731b5dd2c7359c43d764bff69
Instruction Fuzzy Hash: 1122E864B08B03A1EB25BB95E9741B827A1FF49B91F84523DC85E0F724EF3EA559C340

Function 00007FFD93BFB360 Relevance: 93.5, APIs: 47, Strings: 6, Instructions: 727COMMON

Download Yara Rule

APIs

PyErr_Clear.PYTHON313 ref: 00007FFD93BFB393
PyObject_Size.PYTHON313 ref: 00007FFD93BFB39C
PyErr_Format.PYTHON313 ref: 00007FFD93BFB3C4
PyLong_AsLong.PYTHON313 ref: 00007FFD93BFB3D3
PyLong_AsLong.PYTHON313 ref: 00007FFD93BFB3E1
PyLong_AsLong.PYTHON313 ref: 00007FFD93BFB3EF
PyErr_Occurred.PYTHON313 ref: 00007FFD93BFB409
PyObject_Size.PYTHON313 ref: 00007FFD93BFB41B
PyErr_SetString.PYTHON313 ref: 00007FFD93BFB531
_Py_Dealloc.PYTHON313 ref: 00007FFD93BFBDA0

Strings

Allocating ArgHelpers array, xrefs: 00007FFD93BFB520
value, xrefs: 00007FFD93BFBB8E, 00007FFD93BFBC63
The array of argument types must be a tuple whose size is <= to the number of arguments., xrefs: 00007FFD93BFBE4C
The return type information could not be parsed, xrefs: 00007FFD93BFBD00
not enough arguments (at least 5 needed), xrefs: 00007FFD93BFB3B3
The Python object is invalid, xrefs: 00007FFD93BFB738

Memory Dump Source

Source File: 00000002.00000002.3410823626.00007FFD93BF1000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFD93BF0000, based on PE: true

Associated: 00000002.00000002.3410805377.00007FFD93BF0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410893652.00007FFD93C81000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410911924.00007FFD93C8C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410930367.00007FFD93C8D000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410958266.00007FFD93C96000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93bf0000_user.jbxd

Similarity

API ID: Err_$LongLong_$Object_Size$ClearDeallocFormatOccurredString
String ID: Allocating ArgHelpers array$The Python object is invalid$The array of argument types must be a tuple whose size is <= to the number of arguments.$The return type information could not be parsed$not enough arguments (at least 5 needed)$value
API String ID: 2033694642-4244552354
Opcode ID: eec55bf21228184a5226df997738aaa74b7416cdae626d13d11f0294432222ce
Instruction ID: f1b15a509b9dba043391bcffbdc16e4241942144d99fbe2e7c3b17ed36f3926d
Opcode Fuzzy Hash: eec55bf21228184a5226df997738aaa74b7416cdae626d13d11f0294432222ce
Instruction Fuzzy Hash: 17629F36B08B5286EB24DFA5D8642BD6BA4FF44B98F515235DE4E63B94DF38E444C300

Function 00007FFDA35A1C1C Relevance: 70.6, APIs: 37, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFDA35E6EEC
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35E7113
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35E712B
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35E728B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35E72A3
BIO_clear_flags.LIBCRYPTO-3 ref: 00007FFDA35E730E
BIO_set_flags.LIBCRYPTO-3 ref: 00007FFDA35E731B
memcpy.VCRUNTIME140 ref: 00007FFDA35E735A
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35E747D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35E7495
memcpy.VCRUNTIME140 ref: 00007FFDA35E7510
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFDA35E7543
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35E75BB
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35E75D3
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35E75E8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35E7600
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35E76E8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35E7700
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35E7720
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35E7738
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35E774D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35E7765
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35E786E

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFDA35E7124, 00007FFDA35E729C, 00007FFDA35E748E, 00007FFDA35E75CC, 00007FFDA35E75F9, 00007FFDA35E7631, 00007FFDA35E766B, 00007FFDA35E76CC, 00007FFDA35E76F9, 00007FFDA35E7731, 00007FFDA35E775E, 00007FFDA35E77A6, 00007FFDA35E77CD, 00007FFDA35E7867
ssl3_read_bytes, xrefs: 00007FFDA35E7118, 00007FFDA35E7290, 00007FFDA35E7482, 00007FFDA35E75C0, 00007FFDA35E75ED, 00007FFDA35E7625, 00007FFDA35E765F, 00007FFDA35E76C0, 00007FFDA35E76ED, 00007FFDA35E7725, 00007FFDA35E7757, 00007FFDA35E779A, 00007FFDA35E77C6, 00007FFDA35E7860
SSL alert number %d, xrefs: 00007FFDA35E7682

Memory Dump Source

Source File: 00000002.00000002.3413120619.00007FFDA35A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDA35A0000, based on PE: true

Associated: 00000002.00000002.3413103779.00007FFDA35A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413120619.00007FFDA3623000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413218182.00007FFDA364D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3652000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3658000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda35a0000_user.jbxd

Similarity

API ID: R_newR_set_debug$memcpy$L_cleanseO_clear_flagsO_set_flags
String ID: ..\s\ssl\record\rec_layer_s3.c$SSL alert number %d$ssl3_read_bytes
API String ID: 480058824-3615793073
Opcode ID: 6ce1f1e6ab867371c9ac5fdbcfd9244af31884eb36a4143032fe0f8282fb1a6d
Instruction ID: 56d52bdd5b80ff13311324abf6cf98f587b84601882b629f12ca6b342ea26613
Opcode Fuzzy Hash: 6ce1f1e6ab867371c9ac5fdbcfd9244af31884eb36a4143032fe0f8282fb1a6d
Instruction Fuzzy Hash: 18526D31B0E68282FA66DB19D4603B92692EF41784F685135DA4E677DBDF3FE840C708

Function 00007FFDA3678470 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 190
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA36784AB
PyErr_SetString.PYTHON313 ref: 00007FFDA36784F5
PyUnicode_FSConverter.PYTHON313 ref: 00007FFDA3678507
PyErr_ExceptionMatches.PYTHON313 ref: 00007FFDA367851B
PyUnicode_FSConverter.PYTHON313 ref: 00007FFDA367853E
PyErr_ExceptionMatches.PYTHON313 ref: 00007FFDA3678552
PyUnicode_AsASCIIString.PYTHON313 ref: 00007FFDA3678581
PyErr_ExceptionMatches.PYTHON313 ref: 00007FFDA3678599
_Py_Dealloc.PYTHON313 ref: 00007FFDA36785D6
PyObject_CheckBuffer.PYTHON313 ref: 00007FFDA36785F9
PyObject_GetBuffer.PYTHON313 ref: 00007FFDA367860D
PyBuffer_Release.PYTHON313 ref: 00007FFDA3678624
PyBuffer_Release.PYTHON313 ref: 00007FFDA3678652
PyEval_SaveThread.PYTHON313 ref: 00007FFDA3678674
SSL_CTX_load_verify_locations.LIBSSL-3 ref: 00007FFDA3678687
PyEval_RestoreThread.PYTHON313 ref: 00007FFDA3678692
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA367869C
PyErr_SetFromErrno.PYTHON313 ref: 00007FFDA36786B1
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA36786B7
_Py_Dealloc.PYTHON313(?,?,?,?,?,?,?,?,?,00007FFD947961F0,?,?,00007FFD947961F0,?,00007FFD947961F0,00007FFDA3678450), ref: 00007FFDA36786EB
_Py_Dealloc.PYTHON313 ref: 00007FFDA3678705

Strings

capath should be a valid filesystem path, xrefs: 00007FFDA3678560
cadata should be an ASCII string or a bytes-like object, xrefs: 00007FFDA36785A7
cafile, capath and cadata cannot be all omitted, xrefs: 00007FFDA36784E4
cadata should be a contiguous buffer with a single dimension, xrefs: 00007FFDA367862A
cafile should be a valid filesystem path, xrefs: 00007FFDA3678529

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Err_$DeallocExceptionMatchesUnicode_$BufferBuffer_ConverterEval_Object_ReleaseStringThread_errno$CheckErrnoFromR_clear_errorRestoreSaveX_load_verify_locations
String ID: cadata should be a contiguous buffer with a single dimension$cadata should be an ASCII string or a bytes-like object$cafile should be a valid filesystem path$cafile, capath and cadata cannot be all omitted$capath should be a valid filesystem path
API String ID: 3514852180-3904065072
Opcode ID: 4b569e1828d5298e13ff4229d83b18081c11c23e268f6572ed8ed53cd8f90d79
Instruction ID: 0d1f7cc709685782c187b263862e204063526ff63c1ad21bc2a8e7ccc5f3dd03
Opcode Fuzzy Hash: 4b569e1828d5298e13ff4229d83b18081c11c23e268f6572ed8ed53cd8f90d79
Instruction Fuzzy Hash: F7817421B0BA0685FB608F25D56527923A2BF44BD8F9C2431DD0E67796DF3EE848C308

Function 00007FFD93C02950 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 126
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFD93C02972
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFD93C0298A
PyEval_SaveThread.PYTHON313 ref: 00007FFD93C029AE
GetActiveObject.OLEAUT32 ref: 00007FFD93C029C3
PyEval_RestoreThread.PYTHON313 ref: 00007FFD93C029CE
PyEval_SaveThread.PYTHON313 ref: 00007FFD93C029F1
PyEval_RestoreThread.PYTHON313 ref: 00007FFD93C02A21
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFD93C02A44
PyDict_GetItem.PYTHON313 ref: 00007FFD93C02A5C
_Py_Dealloc.PYTHON313 ref: 00007FFD93C02A72
PyErr_Clear.PYTHON313 ref: 00007FFD93C02A7D
PyErr_SetString.PYTHON313 ref: 00007FFD93C02A94
PyEval_SaveThread.PYTHON313 ref: 00007FFD93C02A9A
PyEval_RestoreThread.PYTHON313 ref: 00007FFD93C02AAF
PyObject_IsSubclass.PYTHON313 ref: 00007FFD93C02AC1

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFD93C02AE0
O:Connect, xrefs: 00007FFD93C0296B
There is no interface object registered that supports this IID, xrefs: 00007FFD93C02A83
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFD93C02ACB

Memory Dump Source

Source File: 00000002.00000002.3410823626.00007FFD93BF1000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFD93BF0000, based on PE: true

Associated: 00000002.00000002.3410805377.00007FFD93BF0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410893652.00007FFD93C81000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410911924.00007FFD93C8C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410930367.00007FFD93C8D000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410958266.00007FFD93C96000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93bf0000_user.jbxd

Similarity

API ID: Eval_Thread$Object_RestoreSave$D@@@Err_U_object@@$ActiveArg_ClearDeallocDict_FromItemObjectParseStringSubclassTuple
String ID: O:Connect$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 3189202653-685158464
Opcode ID: fb32afdec469271614cca1a4a8ef09c28be4a29631b2a3156b5743866c1a9132
Instruction ID: 48f65b5e41132242d78ecf0a1afb3ee38fe00f4d567f7dba2a6f9698f531609d
Opcode Fuzzy Hash: fb32afdec469271614cca1a4a8ef09c28be4a29631b2a3156b5743866c1a9132
Instruction Fuzzy Hash: 51512021B08F8285EE749FA6E86417D63A9FF88B84F454036DA4E67764DF3CE505C740

Function 00007FFDA35A14BF Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA35FF1BC
SetLastError.KERNEL32 ref: 00007FFDA35FF1C3
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35FF2A4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35FF2BC
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35FF2E5
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35FF30A
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35FF32C
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35FF34D
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35FF372
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35FF39B
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35FF44B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35FF463
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35FF47E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35FF496
ERR_set_error.LIBCRYPTO-3 ref: 00007FFDA35FF4A8
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FFDA35FF4B3

Strings

state_machine, xrefs: 00007FFDA35FF2AE, 00007FFDA35FF450, 00007FFDA35FF483
..\s\ssl\statem\statem.c, xrefs: 00007FFDA35FF2B5, 00007FFDA35FF45C, 00007FFDA35FF48F

Memory Dump Source

Source File: 00000002.00000002.3413120619.00007FFDA35A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDA35A0000, based on PE: true

Associated: 00000002.00000002.3413103779.00007FFDA35A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413120619.00007FFDA3623000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413218182.00007FFDA364D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3652000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3658000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda35a0000_user.jbxd

Similarity

API ID: R_new$R_set_debug$ErrorLastM_freeR_clear_errorR_set_error
String ID: ..\s\ssl\statem\statem.c$state_machine
API String ID: 1370845099-1722249466
Opcode ID: 0d32384d7316208965964d29d91abcf0daa34d1bc1be83e9d84aa4d08f48a424
Instruction ID: eba9d6965e03afe38c83d17e0b33c70153ae89feaadcbc98fee9b8a7cda8b9d2
Opcode Fuzzy Hash: 0d32384d7316208965964d29d91abcf0daa34d1bc1be83e9d84aa4d08f48a424
Instruction Fuzzy Hash: 08A16231F0F64281FB66AAA9D8613BD2292EF41B44F184436D90D66FDBCE3EE4418319

Function 00007FFDA3545ED0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyUnicode_AsWideCharString.PYTHON313 ref: 00007FFDA3545F22
PyErr_SetString.PYTHON313 ref: 00007FFDA3545F56
PyMem_Free.PYTHON313 ref: 00007FFDA3545F6A
PyErr_Clear.PYTHON313 ref: 00007FFDA3546037
PyErr_SetString.PYTHON313 ref: 00007FFDA354604E

Strings

value is larger than a DWORD, xrefs: 00007FFDA3545F4C
Only strings and iids can be converted to a CLSID., xrefs: 00007FFDA3546044
None is not a valid string in this context, xrefs: 00007FFDA3545FFC
Objects of type '%s' can not be converted to Unicode., xrefs: 00007FFDA3546027
<NULL!!>, xrefs: 00007FFDA3546019

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_String$CharClearFreeMem_Unicode_Wide
String ID: <NULL!!>$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.$Only strings and iids can be converted to a CLSID.$value is larger than a DWORD
API String ID: 443722841-2914159855
Opcode ID: 37b0708b124ef805f6eafb4413cb45e7aa50632965b2a1696fc48efc4bb87208
Instruction ID: 3808edb4a2ca65abc6244fb03b47155356da215fa78120ad2df0637e54044e54
Opcode Fuzzy Hash: 37b0708b124ef805f6eafb4413cb45e7aa50632965b2a1696fc48efc4bb87208
Instruction Fuzzy Hash: 75415E61F0AB4281EF568B1DE4602782763BF88BD4F444131D90F67B66DF6EF5448708

Function 00007FFD93C41010 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 178
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyEval_SaveThread.PYTHON313(?,?,?,?,?,?,?,?,?,00007FFD93C40F55), ref: 00007FFD93C41026
LHashValOfNameSys.OLEAUT32 ref: 00007FFD93C4103C
PyEval_RestoreThread.PYTHON313(?,?,?,?,?,?,?,?,?,00007FFD93C40F55), ref: 00007FFD93C4107C
PyTuple_New.PYTHON313(?,?,?,?,?,?,?,?,?,00007FFD93C40F55), ref: 00007FFD93C410E4
PyTuple_New.PYTHON313(?,?,?,?,?,?,?,?,?,00007FFD93C40F55), ref: 00007FFD93C41282
PyLong_FromLong.PYTHON313(?,?,?,?,?,?,?,?,?,00007FFD93C40F55), ref: 00007FFD93C41294

Part of subcall function 00007FFD93BF4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFD93BF4CFC
Part of subcall function 00007FFD93BF4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFD93BF4D3F
Part of subcall function 00007FFD93BF4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFD93BF4D49
Part of subcall function 00007FFD93BF4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFD93BF4D59
Part of subcall function 00007FFD93BF4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFD93BF4D64
Part of subcall function 00007FFD93BF4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFD93BF4D85
Part of subcall function 00007FFD93BF4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFD93BF4D9C
Part of subcall function 00007FFD93BF4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFD93BF4DBC
Part of subcall function 00007FFD93BF4CC0: Py_BuildValue.PYTHON313 ref: 00007FFD93BF4DDD
Part of subcall function 00007FFD93BF4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFD93BF4DF4
Part of subcall function 00007FFD93BF4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFD93BF4E07
Part of subcall function 00007FFD93BF4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFD93BF4E20

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFD93C411E4
There is no interface object registered that supports this IID, xrefs: 00007FFD93C411A2
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFD93C411CF

Memory Dump Source

Source File: 00000002.00000002.3410823626.00007FFD93BF1000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFD93BF0000, based on PE: true

Associated: 00000002.00000002.3410805377.00007FFD93BF0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410893652.00007FFD93C81000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410911924.00007FFD93C8C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410930367.00007FFD93C8D000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410958266.00007FFD93C96000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93bf0000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocFromTuple_$BuildErr_ErrorHashInfoLongLong_NameObjectObject_U_object@@Value
String ID: The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 3698739723-49823770
Opcode ID: 5804f62f2bd91cdc706f36869b61dbd82ed5bf92c8980cc4d7a103c0c7ca2645
Instruction ID: 4143ed3ae1f96fae832fcd91659d042c7a8b0d3c83609f435431dafa28fbddb2
Opcode Fuzzy Hash: 5804f62f2bd91cdc706f36869b61dbd82ed5bf92c8980cc4d7a103c0c7ca2645
Instruction Fuzzy Hash: 52712E22B0DF4282EA749FA5E46827D63A8FF89B94F454035DA8EA7794DF2DE444C700

Function 00007FFDA36791B8 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 163
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFDA3673C98: PyWeakref_GetRef.PYTHON313 ref: 00007FFDA3673CAA
Part of subcall function 00007FFDA3673C98: _Py_Dealloc.PYTHON313 ref: 00007FFDA3673CCC

SSL_get_rbio.LIBSSL-3 ref: 00007FFDA367923A
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFDA367924F
SSL_get_wbio.LIBSSL-3 ref: 00007FFDA3679259
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFDA367926A
_PyDeadline_Init.PYTHON313 ref: 00007FFDA3679280
PyEval_SaveThread.PYTHON313 ref: 00007FFDA3679291
SSL_do_handshake.LIBSSL-3 ref: 00007FFDA367929E
PyEval_RestoreThread.PYTHON313 ref: 00007FFDA36792D9
PyErr_CheckSignals.PYTHON313 ref: 00007FFDA36792F0
_PyDeadline_Get.PYTHON313 ref: 00007FFDA3679308
_Py_Dealloc.PYTHON313 ref: 00007FFDA367936C
PyErr_SetString.PYTHON313 ref: 00007FFDA36793A8
_Py_Dealloc.PYTHON313 ref: 00007FFDA36793C0

Part of subcall function 00007FFDA3676750: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFDA3676768
Part of subcall function 00007FFDA3676750: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA3676791

Strings

_ssl.c:1003: The handshake operation timed out, xrefs: 00007FFDA36793F5
_ssl.c:1011: Underlying socket too large for select()., xrefs: 00007FFDA367938C
Underlying socket connection gone, xrefs: 00007FFDA3679205
_ssl.c:1007: Underlying socket has been closed., xrefs: 00007FFDA3679395

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Dealloc$Deadline_Err_Eval_O_ctrlThread$CheckInitL_do_handshakeL_get_rbioL_get_wbioR_clear_errorR_peek_last_errorRestoreSaveSignalsStringWeakref_
String ID: Underlying socket connection gone$_ssl.c:1003: The handshake operation timed out$_ssl.c:1007: Underlying socket has been closed.$_ssl.c:1011: Underlying socket too large for select().
API String ID: 288340648-2389777663
Opcode ID: 7265f02c1a542241e3f7e2062acdd0cc4db0a65ef925610e45703ceb09e98bfe
Instruction ID: 676ce3c58e9ce19f79c8fb89d495efe411eb3eaae79c8e7c26f529837a0a6cc1
Opcode Fuzzy Hash: 7265f02c1a542241e3f7e2062acdd0cc4db0a65ef925610e45703ceb09e98bfe
Instruction Fuzzy Hash: 76617231B0AA428AFB60DF22946447923E2FF85B94F982431DD4E67796DF3EE4458348

Function 00007FFD93BFBE90 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFD93BFBEBF
PyErr_SetString.PYTHON313 ref: 00007FFD93BFBEDC
PyEval_SaveThread.PYTHON313 ref: 00007FFD93BFBF0C
PyEval_RestoreThread.PYTHON313 ref: 00007FFD93BFBF32
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFD93BFBF9E
PyDict_GetItem.PYTHON313 ref: 00007FFD93BFBFB6
_Py_Dealloc.PYTHON313 ref: 00007FFD93BFBFCC
PyErr_Clear.PYTHON313 ref: 00007FFD93BFBFD7
PyErr_SetString.PYTHON313 ref: 00007FFD93BFBFEE
PyEval_SaveThread.PYTHON313 ref: 00007FFD93BFBFF4
PyEval_RestoreThread.PYTHON313 ref: 00007FFD93BFC009

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFD93BFC04C
|ii:GetTypeInfo, xrefs: 00007FFD93BFBEB8
There is no interface object registered that supports this IID, xrefs: 00007FFD93BFBFDD
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFD93BFC037
The Python object is invalid, xrefs: 00007FFD93BFBECE

Memory Dump Source

Source File: 00000002.00000002.3410823626.00007FFD93BF1000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFD93BF0000, based on PE: true

Associated: 00000002.00000002.3410805377.00007FFD93BF0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410893652.00007FFD93C81000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410911924.00007FFD93C8C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410930367.00007FFD93C8D000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410958266.00007FFD93C96000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93bf0000_user.jbxd

Similarity

API ID: Eval_Thread$Err_$RestoreSaveString$Arg_ClearD@@@DeallocDict_FromItemObject_ParseTupleU_object@@
String ID: The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$|ii:GetTypeInfo
API String ID: 2945167311-1333789200
Opcode ID: c12a8f3d87f37f9b06d4fb00c08d740b5285eb880e27b4f63054bd0b6c6bdd9d
Instruction ID: 597241f39778044d6ed41944223bc090922af48a705f72b774c4bd98c4d7bb91
Opcode Fuzzy Hash: c12a8f3d87f37f9b06d4fb00c08d740b5285eb880e27b4f63054bd0b6c6bdd9d
Instruction Fuzzy Hash: 94515D36B08B4686EA60EFA9F8241AD63A8FB88B94F495431DE8D27754DF3CE445C700

Function 00007FFDA3574760 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyImport_ImportModuleLevelObject.PYTHON313 ref: 00007FFDA3574791
PyObject_GetAttr.PYTHON313 ref: 00007FFDA35747DD
PyUnicode_FromFormat.PYTHON313 ref: 00007FFDA35747FD
PyObject_GetItem.PYTHON313 ref: 00007FFDA3574815
_Py_Dealloc.PYTHON313 ref: 00007FFDA357482C
PyDict_SetItem.PYTHON313 ref: 00007FFDA357484D
PyObject_SetItem.PYTHON313 ref: 00007FFDA3574855
_Py_Dealloc.PYTHON313 ref: 00007FFDA357486B
PyErr_Clear.PYTHON313 ref: 00007FFDA357489B
PyModule_GetFilenameObject.PYTHON313 ref: 00007FFDA35748A4
PyUnicode_FromFormat.PYTHON313 ref: 00007FFDA35748C2
PyErr_SetImportError.PYTHON313 ref: 00007FFDA35748D9
_Py_Dealloc.PYTHON313 ref: 00007FFDA35748ED
_Py_Dealloc.PYTHON313 ref: 00007FFDA3574901
_Py_Dealloc.PYTHON313 ref: 00007FFDA3574915

Strings

%U.%U, xrefs: 00007FFDA35747F3
cannot import name %R from %R (%S), xrefs: 00007FFDA35748B2

Memory Dump Source

Source File: 00000002.00000002.3413027920.00007FFDA3571000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFDA3570000, based on PE: true

Associated: 00000002.00000002.3413010503.00007FFDA3570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.3413049733.00007FFDA3585000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.3413068786.00007FFDA358B000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.3413086728.00007FFDA358F000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3570000_user.jbxd

Similarity

API ID: Dealloc$ItemObject_$Err_FormatFromImportObjectUnicode_$AttrClearDict_ErrorFilenameImport_LevelModuleModule_
String ID: %U.%U$cannot import name %R from %R (%S)
API String ID: 3630264407-438398067
Opcode ID: aea79ed82b41080dcdede2459c0bc734a1ab5dbcbebbb0792b6c7292410103bd
Instruction ID: 50498df76875dc839bb08a126160cd30f4b5d85b9f1e3bb92e2f380fa01e873e
Opcode Fuzzy Hash: aea79ed82b41080dcdede2459c0bc734a1ab5dbcbebbb0792b6c7292410103bd
Instruction Fuzzy Hash: 04518571B0EA8682EB169F1AE86427963A2FB45FD5F844830CE4E63756DF3EE045D304

Function 00007FFDA35A1C62 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFDA3606014
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA360602C
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA3606061
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFDA3606076
X509_get0_pubkey.LIBCRYPTO-3 ref: 00007FFDA3606081
ERR_new.LIBCRYPTO-3 ref: 00007FFDA36060B7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA36060CF
ERR_new.LIBCRYPTO-3 ref: 00007FFDA3606114
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA360612C

Strings

tls_post_process_server_certificate, xrefs: 00007FFDA3606019, 00007FFDA36060BC, 00007FFDA3606119, 00007FFDA36061EB
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFDA3606025, 00007FFDA36060C8, 00007FFDA3606125, 00007FFDA36061F7

Memory Dump Source

Source File: 00000002.00000002.3413120619.00007FFDA35A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDA35A0000, based on PE: true

Associated: 00000002.00000002.3413103779.00007FFDA35A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413120619.00007FFDA3623000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413218182.00007FFDA364D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3652000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3658000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda35a0000_user.jbxd

Similarity

API ID: R_newR_set_debug$L_sk_valueR_clear_errorX509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c$tls_post_process_server_certificate
API String ID: 2779586248-3767186838
Opcode ID: 4b3c939a7b197642555fd03858451e68e0e2822e76a72f073d6beb959d7d97e5
Instruction ID: a74e2af42b1fe97469afa448c5b1e2e6f226e70ee68d6e08e22baa11508f4546
Opcode Fuzzy Hash: 4b3c939a7b197642555fd03858451e68e0e2822e76a72f073d6beb959d7d97e5
Instruction Fuzzy Hash: AC51A061B0A68281F750DB19D4663BD2762EF86B84F4C6031ED0D6B7DBDF2EE5818708

Function 00007FFDA35A14F1 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFDA35E7C05
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35E7C1D
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35E7D0D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35E7D25
SetLastError.KERNEL32 ref: 00007FFDA35E7D72
BIO_read.LIBCRYPTO-3 ref: 00007FFDA35E7D99
BIO_test_flags.LIBCRYPTO-3 ref: 00007FFDA35E7DBC
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFDA35E7DD4
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35E7E2C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35E7E44
ERR_new.LIBCRYPTO-3 ref: 00007FFDA35E7E95
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35E7EAD

Strings

ssl3_read_n, xrefs: 00007FFDA35E7C0A, 00007FFDA35E7D12, 00007FFDA35E7E31, 00007FFDA35E7E9A
..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFDA35E7C16, 00007FFDA35E7D1E, 00007FFDA35E7E3D, 00007FFDA35E7EA6

Memory Dump Source

Source File: 00000002.00000002.3413120619.00007FFDA35A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDA35A0000, based on PE: true

Associated: 00000002.00000002.3413103779.00007FFDA35A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413120619.00007FFDA3623000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413218182.00007FFDA364D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3652000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3658000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda35a0000_user.jbxd

Similarity

API ID: R_newR_set_debug$ErrorLastO_ctrlO_readO_test_flags
String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_read_n
API String ID: 3359833097-4226281315
Opcode ID: 8ebe03c6254369f7a723c3bcb68090796815b0d3cdd902c278eaeef658847182
Instruction ID: ee516818690a83a2c0faa2918d7860e3ad5ed0a27914fa228059d6211f269fca
Opcode Fuzzy Hash: 8ebe03c6254369f7a723c3bcb68090796815b0d3cdd902c278eaeef658847182
Instruction Fuzzy Hash: 23A1AF31B0AB9681FB56DF29D9207B92296EF44B84F684131DD4D2BBCADF3ED4458308

Function 00007FF715751950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF715757F90: _fread_nolock.LIBCMT ref: 00007FF71575803A

_fread_nolock.LIBCMT ref: 00007FF715751A1B

Part of subcall function 00007FF715752910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF715751B6A), ref: 00007FF71575295E

Strings

Failed to seek to cookie position!, xrefs: 00007FF7157519EE
Failed to read cookie!, xrefs: 00007FF715751A2B
fread, xrefs: 00007FF715751A32, 00007FF715751B5C
malloc, xrefs: 00007FF715751B22
fseek, xrefs: 00007FF7157519F5
Could not allocate buffer for TOC!, xrefs: 00007FF715751B1B
Error on file., xrefs: 00007FF715751B8D
calloc, xrefs: 00007FF715751A68
Could not read full TOC!, xrefs: 00007FF715751B55
MEI, xrefs: 00007FF715751991
Could not allocate memory for archive structure!, xrefs: 00007FF715751A61

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: b426b7569fd43417053a9482fb0298cff99dadbc456d732c1d031cb9eee9613e
Instruction ID: 1623f6d8500d97f15ce508b92b8c6abf3c46184d4ff88c40aa685badf6eebc07
Opcode Fuzzy Hash: b426b7569fd43417053a9482fb0298cff99dadbc456d732c1d031cb9eee9613e
Instruction Fuzzy Hash: 5381C571A18E8686E718FB14E0462F9A3A1AF4CF64FC44531EA8D437A5DF3CE54D8760

Function 00007FFDA35FECC0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

read_state_machine, xrefs: 00007FFDA35FEF4D, 00007FFDA35FEF8A, 00007FFDA35FEFB2, 00007FFDA35FF025
..\s\ssl\statem\statem.c, xrefs: 00007FFDA35FEF54, 00007FFDA35FEF91, 00007FFDA35FEFBE, 00007FFDA35FF031

Memory Dump Source

Source File: 00000002.00000002.3413120619.00007FFDA35A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDA35A0000, based on PE: true

Associated: 00000002.00000002.3413103779.00007FFDA35A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413120619.00007FFDA3623000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413218182.00007FFDA364D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3652000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3658000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda35a0000_user.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem.c$read_state_machine
API String ID: 0-3323778802
Opcode ID: c8972936501a879b7e84c5051af7770807ba9d65b882bacb7b5450dec163fd8f
Instruction ID: f31a3e08a1ec76c56e3d5cd2873f07e024c40dfcf52bcebd2758f1ef49cdb3f0
Opcode Fuzzy Hash: c8972936501a879b7e84c5051af7770807ba9d65b882bacb7b5450dec163fd8f
Instruction Fuzzy Hash: DB918F31B0B68282F7119F29D4643B92792EF41B48F584136DA0D67BDACF3EE546D348

Function 00007FFDA3671000 Relevance: 21.1, APIs: 14, Instructions: 117COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON313 ref: 00007FFDA3671012
PyDict_New.PYTHON313 ref: 00007FFDA367101B
PyDict_New.PYTHON313 ref: 00007FFDA367102E
PyUnicode_FromString.PYTHON313 ref: 00007FFDA3671063
Py_BuildValue.PYTHON313 ref: 00007FFDA3671082
PyDict_SetItem.PYTHON313 ref: 00007FFDA367109E
PyLong_FromLong.PYTHON313 ref: 00007FFDA36710F3
PyUnicode_FromString.PYTHON313 ref: 00007FFDA36710FF
PyDict_SetItem.PYTHON313 ref: 00007FFDA367111C
_Py_Dealloc.PYTHON313 ref: 00007FFDA36739FB
_Py_Dealloc.PYTHON313 ref: 00007FFDA3673A2C

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Dict_$From$DeallocItemStringUnicode_$BuildLongLong_Module_StateValue
String ID:
API String ID: 4070576976-0
Opcode ID: 2f580570dadecae92c3f8d5133122cd99a9884c04237f7c08c2005058d65d428
Instruction ID: 39f46e90813a59fc16240df08110324900d2718a9a90ca0b02a76ade73fbb93e
Opcode Fuzzy Hash: 2f580570dadecae92c3f8d5133122cd99a9884c04237f7c08c2005058d65d428
Instruction Fuzzy Hash: D9414035B0B743C1FA549F11A82437826A6BF46B85F8C6031CA1D66397EF3EE445C358

Function 00007FFDA3579263 Relevance: 19.6, APIs: 13, Instructions: 139COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA35742E0: PyUnicode_FromStringAndSize.PYTHON313 ref: 00007FFDA35743E9
Part of subcall function 00007FFDA35742E0: PyUnicode_InternInPlace.PYTHON313 ref: 00007FFDA3574402

_Py_Dealloc.PYTHON313 ref: 00007FFDA35792CB
_Py_Dealloc.PYTHON313 ref: 00007FFDA3579300
_Py_Dealloc.PYTHON313 ref: 00007FFDA3579318
_Py_Dealloc.PYTHON313 ref: 00007FFDA357933B
_Py_Dealloc.PYTHON313 ref: 00007FFDA357935E
_Py_Dealloc.PYTHON313 ref: 00007FFDA3579381
_Py_Dealloc.PYTHON313 ref: 00007FFDA35793A4
_Py_Dealloc.PYTHON313 ref: 00007FFDA35793C7
_Py_Dealloc.PYTHON313 ref: 00007FFDA35793EA
_Py_Dealloc.PYTHON313 ref: 00007FFDA357940D
_Py_Dealloc.PYTHON313 ref: 00007FFDA3579430
_Py_Dealloc.PYTHON313 ref: 00007FFDA3579453
_Py_Dealloc.PYTHON313 ref: 00007FFDA3579476

Memory Dump Source

Source File: 00000002.00000002.3413027920.00007FFDA3571000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFDA3570000, based on PE: true

Associated: 00000002.00000002.3413010503.00007FFDA3570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.3413049733.00007FFDA3585000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.3413068786.00007FFDA358B000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.3413086728.00007FFDA358F000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3570000_user.jbxd

Similarity

API ID: Dealloc$Unicode_$FromInternPlaceSizeString
String ID:
API String ID: 2745024575-0
Opcode ID: e3abe80e124aa434e129e5a5323edaca9fc8b80d125148bed174b3bde365830c
Instruction ID: 5a79afe5746af4e456da4a365ad1919590415a0ec461786993b41f795fba8a34
Opcode Fuzzy Hash: e3abe80e124aa434e129e5a5323edaca9fc8b80d125148bed174b3bde365830c
Instruction Fuzzy Hash: DE711835F0FA028AFA579F6EA97413833A7AF41B54F944934C50E627A3DF2F60459328

Function 00007FFD93C140B0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 54libraryloaderthreadCOMMON

Download Yara Rule

APIs

?PyWin_AcquireGlobalLock@@YAXXZ.PYWINTYPES313(?,?,?,?,?,00007FFD93C04322), ref: 00007FFD93C140BF
GetCurrentThreadId.KERNEL32 ref: 00007FFD93C140CF
GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FFD93C04322), ref: 00007FFD93C140E8
GetProcAddress.KERNEL32(?,?,?,?,?,00007FFD93C04322), ref: 00007FFD93C14104
?PyWin_ReleaseGlobalLock@@YAXXZ.PYWINTYPES313(?,?,?,?,?,00007FFD93C04322), ref: 00007FFD93C14160

Strings

ole32.dll, xrefs: 00007FFD93C140E1
CoInitializeEx failed (0x%08lx), xrefs: 00007FFD93C1412D
CoInitializeEx, xrefs: 00007FFD93C140FA

Memory Dump Source

Source File: 00000002.00000002.3410823626.00007FFD93BF1000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFD93BF0000, based on PE: true

Associated: 00000002.00000002.3410805377.00007FFD93BF0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410893652.00007FFD93C81000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410911924.00007FFD93C8C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410930367.00007FFD93C8D000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410958266.00007FFD93C96000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93bf0000_user.jbxd

Similarity

API ID: GlobalLock@@Win_$AcquireAddressCurrentHandleModuleProcReleaseThread
String ID: CoInitializeEx$CoInitializeEx failed (0x%08lx)$ole32.dll
API String ID: 2699693448-4213856137
Opcode ID: 8a952fc43bd525437a0d6f348abac8e58cc68f4b7ebf1dc6150318704ae46fdd
Instruction ID: 864ea4b0b24157fa56b19817192d8beaa0de68fa38dc1d5c6c0e80cb5c2fb4d3
Opcode Fuzzy Hash: 8a952fc43bd525437a0d6f348abac8e58cc68f4b7ebf1dc6150318704ae46fdd
Instruction Fuzzy Hash: 02216020F0CE0796F7B09BE2A87827F27BDAF56744F504035C50D662A0EEBDE485A700

Function 00007FFDA35FF6B0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,FFFFFFFF,00000000,00007FFDA35FF416), ref: 00007FFDA35FF762
ERR_set_debug.LIBCRYPTO-3(?,?,FFFFFFFF,00000000,00007FFDA35FF416), ref: 00007FFDA35FF77A

Strings

write_state_machine, xrefs: 00007FFDA35FF76C, 00007FFDA35FFA5B
..\s\ssl\statem\statem.c, xrefs: 00007FFDA35FF773, 00007FFDA35FFA62

Memory Dump Source

Source File: 00000002.00000002.3413120619.00007FFDA35A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDA35A0000, based on PE: true

Associated: 00000002.00000002.3413103779.00007FFDA35A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413120619.00007FFDA3623000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413218182.00007FFDA364D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3652000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3658000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda35a0000_user.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem.c$write_state_machine
API String ID: 193678381-552286378
Opcode ID: e5d1fe94fccde403d4ccffd35c49600b4c13cc4e7178492653a3fc2a8d140b00
Instruction ID: 9926a3e32826a960c75116eec5ae4937ba399a8f146e42dee089e5fd20026e34
Opcode Fuzzy Hash: e5d1fe94fccde403d4ccffd35c49600b4c13cc4e7178492653a3fc2a8d140b00
Instruction Fuzzy Hash: CDA18F32B0B68282EB669F69D4643B92362FB40B48F484136D94D67FD6CF3EE945C704

Function 00007FFDA3672150 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FFDA36721B2
PyUnicode_AsUTF8AndSize.PYTHON313 ref: 00007FFDA36721EE
PyObject_IsTrue.PYTHON313 ref: 00007FFDA3672223

Strings

str, xrefs: 00007FFDA3673B32
embedded null character, xrefs: 00007FFDA3673B53
txt2obj, xrefs: 00007FFDA3673B39
argument 'txt', xrefs: 00007FFDA3673B2B

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Arg_KeywordsObject_SizeTrueUnicode_Unpack
String ID: argument 'txt'$embedded null character$str$txt2obj
API String ID: 3371007025-2001486153
Opcode ID: 2320e4280f1f69ba6e36c6f1d629554bc59a245645e9aff284964197e01a69df
Instruction ID: 5be014f251f91314915d936f6c803420613bde1083e87c6dbc6dce1eb815dda0
Opcode Fuzzy Hash: 2320e4280f1f69ba6e36c6f1d629554bc59a245645e9aff284964197e01a69df
Instruction Fuzzy Hash: 4931B522B0EA4685FA60CB11E4643B52762FF98B90F8C6131DE5E67B96DF3ED045C308

Function 00007FF715751470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF715751518
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7157515DF
fread, xrefs: 00007FF7157515E6
malloc, xrefs: 00007FF71575151F
fseek, xrefs: 00007FF7157514E5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF71575149F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7157514DE

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 72f99dadd0a2177c1d42b060d7648ca84eb7dddf70f4030becfdb2944091b5e7
Instruction ID: b0d2092d73608b7882515d4baf22f346914c7b7a5ddc5594e6f1316aa9ee1411
Opcode Fuzzy Hash: 72f99dadd0a2177c1d42b060d7648ca84eb7dddf70f4030becfdb2944091b5e7
Instruction Fuzzy Hash: DD417721B18A4285EA18EB22A4465B5E3A1AF4CFA4FC44532ED4D077B5DF3CE54DC760

Function 00007FF715751210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON

Download Yara Rule

Strings

1.3.1, xrefs: 00007FF715751249
malloc, xrefs: 00007FF7157512C1, 00007FF7157512F6
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF715751276
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF71575141E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7157512EF
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7157512BA

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 4176682b56444a78b74e0a45c684f191b40491c6c63e868bb09f8baa48a37ad0
Instruction ID: e2d23bdcd13ce99fa414081e68190c3ff2075da278b02426896d912f07418116
Opcode Fuzzy Hash: 4176682b56444a78b74e0a45c684f191b40491c6c63e868bb09f8baa48a37ad0
Instruction Fuzzy Hash: 6B51F422A18E4245E629BB11E4523BAA2A1BF48FA4FC44131EE8D477E5EF3CE44DC750

Function 00007FF7157536B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF715753804), ref: 00007FF7157536E1
GetLastError.KERNEL32(?,00007FF715753804), ref: 00007FF7157536EB

Part of subcall function 00007FF715752C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF715753706,?,00007FF715753804), ref: 00007FF715752C9E
Part of subcall function 00007FF715752C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF715753706,?,00007FF715753804), ref: 00007FF715752D63
Part of subcall function 00007FF715752C50: MessageBoxW.USER32 ref: 00007FF715752D99

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF715753790
\\?\, xrefs: 00007FF71575375A
Failed to resolve full path to executable %ls., xrefs: 00007FF715753739
Failed to obtain executable path., xrefs: 00007FF7157536F3
GetModuleFileNameW, xrefs: 00007FF7157536FA

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: c4d71bf10c2763e0040e843a1221c981981e04cb3a3c9c4e6e97007468ef44c9
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 4F216251F28E4245FA28BB20E8563B6A364BF4CB64FC00631E65D865F5EF2CE50CC360

Function 00007FF71576BA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71576BE89

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction ID: 422602cfbf567bf6591091c9953e97bd971fa8f0e9a59770bd9e12cc26855e7e
Opcode Fuzzy Hash: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction Fuzzy Hash: 09C1D43290CE8681F668BB1594462BDAB55FB8AFA0FD54231EA4D077A1CF7CE44D8720

Function 00007FFDA36115A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFDA36116C6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA36116DE
ERR_new.LIBCRYPTO-3 ref: 00007FFDA3611761
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA3611779

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFDA36116D7, 00007FFDA3611772
tls_get_message_header, xrefs: 00007FFDA36116CB, 00007FFDA3611766

Memory Dump Source

Source File: 00000002.00000002.3413120619.00007FFDA35A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDA35A0000, based on PE: true

Associated: 00000002.00000002.3413103779.00007FFDA35A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413120619.00007FFDA3623000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413218182.00007FFDA364D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3652000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3658000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda35a0000_user.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_get_message_header
API String ID: 193678381-2714770296
Opcode ID: f45773da2448751231a1ca749fc05bc9d2df97a6a3f744ec35cbeb086fc78321
Instruction ID: 20544b953a26492662ac32e3286a7e31b5eced39fbe552e6d9fd761324bc3888
Opcode Fuzzy Hash: f45773da2448751231a1ca749fc05bc9d2df97a6a3f744ec35cbeb086fc78321
Instruction Fuzzy Hash: 83618A32B0978285FB908F25E4643B937A2EB44B48F1C9036DA8D67796DF3ED4618718

Function 00007FF715756360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

LoadLibrary, xrefs: 00007FF7157564AE
ucrtbase.dll, xrefs: 00007FF7157563DD
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7157563C7
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF715756456
Failed to load Python DLL '%ls'., xrefs: 00007FF7157564A7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF715756407

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction ID: 421fea98dc5bd6598a7fec6face8bad1549ab8b6cb4dfc55c5332cf0e9a16b49
Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction Fuzzy Hash: 0F415721A28E8691EA19FB10F4161E9A325FF4CB64FD00132EA5D476B5DF3CE60DC760

Function 00007FFDA35BFD40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFDA35BFD62
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDA35BFD7A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFDA35BFD8C
ASYNC_get_current_job.LIBCRYPTO-3 ref: 00007FFDA35BFDDB

Strings

SSL_do_handshake, xrefs: 00007FFDA35BFD67
..\s\ssl\ssl_lib.c, xrefs: 00007FFDA35BFD73

Memory Dump Source

Source File: 00000002.00000002.3413120619.00007FFDA35A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDA35A0000, based on PE: true

Associated: 00000002.00000002.3413103779.00007FFDA35A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413120619.00007FFDA3623000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413218182.00007FFDA364D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3652000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3658000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda35a0000_user.jbxd

Similarity

API ID: C_get_current_jobR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_do_handshake
API String ID: 2134390360-2964568172
Opcode ID: 3e19f5133db6f9f0995d995d45ee5f37c3958f709a5efffcd3d50ec949d9a66b
Instruction ID: 578f52fa68c1fba3723e04908f1e5604ca73c5cb7af1fa2b251c3b302d74bf3f
Opcode Fuzzy Hash: 3e19f5133db6f9f0995d995d45ee5f37c3958f709a5efffcd3d50ec949d9a66b
Instruction Fuzzy Hash: A521D322F0978242FB41AB39E4213B95353EF88B94F5C1231E94D677D7DE2ED5818648

Function 00007FFD93C40EA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFD93C40ECA
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFD93C40EE8
PyErr_SetString.PYTHON313 ref: 00007FFD93C40F40
?PyWinObject_FreeBstr@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFD93C40F5D

Strings

O|i:Bind, xrefs: 00007FFD93C40EBC
The Python object is invalid, xrefs: 00007FFD93C40F32

Memory Dump Source

Source File: 00000002.00000002.3410823626.00007FFD93BF1000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFD93BF0000, based on PE: true

Associated: 00000002.00000002.3410805377.00007FFD93BF0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410864735.00007FFD93C4E000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410893652.00007FFD93C81000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410911924.00007FFD93C8C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410930367.00007FFD93C8D000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3410958266.00007FFD93C96000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93bf0000_user.jbxd

Similarity

API ID: Bstr@@Object_$Arg_Err_FreeParseStringTupleU_object@@
String ID: O|i:Bind$The Python object is invalid
API String ID: 3061223275-2584696442
Opcode ID: 0d960c27681c90812c89b8f24a092050a8bec021980732a51c3a71dcb4ad7379
Instruction ID: 60c71b12e4e60e7e7556d0e47c4aa9bfe93ac0fa7188cc6550085dbbfc76c39b
Opcode Fuzzy Hash: 0d960c27681c90812c89b8f24a092050a8bec021980732a51c3a71dcb4ad7379
Instruction Fuzzy Hash: 15214126B18B5282EE608FA6F86417EE3A4FB88BD0B480436EE4D17B58DF7CD545C700

Function 00007FFDA3672260 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

OBJ_txt2obj.LIBCRYPTO-3 ref: 00007FFDA3672280
PyModule_GetState.PYTHON313 ref: 00007FFDA3672295

Part of subcall function 00007FFDA36722C8: OBJ_obj2nid.LIBCRYPTO-3(?,?,?,?,?,00007FFDA36722A6), ref: 00007FFDA36722EA
Part of subcall function 00007FFDA36722C8: OBJ_nid2sn.LIBCRYPTO-3(?,?,?,?,?,00007FFDA36722A6), ref: 00007FFDA36722FC
Part of subcall function 00007FFDA36722C8: OBJ_nid2ln.LIBCRYPTO-3(?,?,?,?,?,00007FFDA36722A6), ref: 00007FFDA3672307
Part of subcall function 00007FFDA36722C8: Py_BuildValue.PYTHON313(?,?,?,?,?,00007FFDA36722A6), ref: 00007FFDA3672335

ASN1_OBJECT_free.LIBCRYPTO-3 ref: 00007FFDA36722AC
PyErr_Format.PYTHON313 ref: 00007FFDA3673B7E

Strings

unknown object '%.100s', xrefs: 00007FFDA3673B71

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: BuildErr_FormatJ_nid2lnJ_nid2snJ_obj2nidJ_txt2objModule_StateT_freeValue
String ID: unknown object '%.100s'
API String ID: 3313133940-3113687063
Opcode ID: a3d5c27b3a59ceb3e9b76a6530f941593e8bf70ef6e0805ff994e8b2e3df9fe0
Instruction ID: c099c00e5489da4e2260183f373cd0c22e2b2be9e36fe6b61e35b221af5c0b36
Opcode Fuzzy Hash: a3d5c27b3a59ceb3e9b76a6530f941593e8bf70ef6e0805ff994e8b2e3df9fe0
Instruction Fuzzy Hash: F1F08611B1AB4281FE04CB67B9740395362AF8CFD0B8CA430DD1E67B56DF2DE0458708

Function 00007FF715765628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715765655
CreateFileW.KERNEL32 ref: 00007FF715765694
CloseHandle.KERNEL32 ref: 00007FF7157656C9

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: 69623b875914c60f1f326beb389cf820c9365203e18643b203d5ffe72539cd15
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: 5141A662D18B8183F718AF209555379A361FB98B74F909335E65C03AE1DF7CA0EC9710

Function 00007FF71575CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF71575CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF71575CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF71575CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF71575CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF71575CD21

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: fdc568e14c2ef1a38ac3ee67fbe6a21bc3c743d5fea42a1d8d7e8780c5c1106f
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 47315B21E28A4745FA5CBB61D4173B993A59F49FA4FC45234EA0D472F3DF2CA90D8230

Function 00007FFDA3582BDD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FFDA3582BE9

Strings

<module>, xrefs: 00007FFDA3583EFB

Memory Dump Source

Source File: 00000002.00000002.3413027920.00007FFDA3571000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFDA3570000, based on PE: true

Associated: 00000002.00000002.3413010503.00007FFDA3570000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.3413049733.00007FFDA3585000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.3413068786.00007FFDA358B000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000002.00000002.3413086728.00007FFDA358F000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3570000_user.jbxd

Similarity

API ID: Dealloc
String ID: <module>
API String ID: 3617616757-217463007
Opcode ID: 38ba6ef64a3c4e3da176dcc799c31920718849fe8b93e96334157dff539b19ff
Instruction ID: ee391f549b4bdb391482efd8db2bd1201864a6b2f600951a6233273278cd6d6f
Opcode Fuzzy Hash: 38ba6ef64a3c4e3da176dcc799c31920718849fe8b93e96334157dff539b19ff
Instruction Fuzzy Hash: BDF03095F0B64742F6139F1EEC2107516636F51796F800471E90D223A2DE2FE4826318

Function 00007FFDA35FF070 Relevance: 3.3, APIs: 2, Instructions: 303COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA35FF1BC
SetLastError.KERNEL32 ref: 00007FFDA35FF1C3
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FFDA35FF4B3

Memory Dump Source

Source File: 00000002.00000002.3413120619.00007FFDA35A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDA35A0000, based on PE: true

Associated: 00000002.00000002.3413103779.00007FFDA35A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413120619.00007FFDA3623000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413218182.00007FFDA364D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3652000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3658000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda35a0000_user.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: 8603938ac5e1fbf28ba7d9b8f40a04eb8b77d7e104ff7c3c46d49aacb8bdd123
Instruction ID: d3d328eeae80a75031a186c430d2d0d863b1dae5ff076b9a73729ba027fbd584
Opcode Fuzzy Hash: 8603938ac5e1fbf28ba7d9b8f40a04eb8b77d7e104ff7c3c46d49aacb8bdd123
Instruction Fuzzy Hash: 5321D432F0F78289F7659E6DA86527D22A2EF00B84F184436DA4852FC7DF3AE441C619

Function 00007FF71576013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715760180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF715760277

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: c5239912223b6b39e696dd360367380750b1286d9004db4d69bcb10c2ea881c5
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: B951FA61B19A4186F76EB926940667EA6A1AF48FB4F884734DD6D037E5CF3CE40C8620

Function 00007FFDA35A1DF7 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA35FF1BC
SetLastError.KERNEL32 ref: 00007FFDA35FF1C3
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FFDA35FF4B3

Memory Dump Source

Source File: 00000002.00000002.3413120619.00007FFDA35A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDA35A0000, based on PE: true

Associated: 00000002.00000002.3413103779.00007FFDA35A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413120619.00007FFDA3623000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413218182.00007FFDA364D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3652000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3658000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda35a0000_user.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: 9e1f5a9259e0aa48b60180f011c1c6fd63c9391dcfad61ef29b2cdf2ae2c5ec5
Instruction ID: f5d1f0ed5993316fa4354e297a3fd7dbe70092711c9489de2ba2998fd64c0be5
Opcode Fuzzy Hash: 9e1f5a9259e0aa48b60180f011c1c6fd63c9391dcfad61ef29b2cdf2ae2c5ec5
Instruction Fuzzy Hash: 8921A132F0F64285F766AE6DA86527D2292EF00B44F284432D90D66FD7CE3EE841C619

Function 00007FF71576C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF71576C2CD), ref: 00007FF71576C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF71576C2CD), ref: 00007FF71576C18A

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 3de893c62bfde02b6acb00400a48806d9b7f22f453cb75ce89d62a9cdaaef48c
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 8911E262A18E8181EA28AB25F805069B361EB49FF0F940331EE7D0B7E8CF3CD01C8710

Function 00007FF71576AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF71576A9D5,?,?,00000000,00007FF71576AA8A), ref: 00007FF71576ABC6
GetLastError.KERNEL32(?,?,?,00007FF71576A9D5,?,?,00000000,00007FF71576AA8A), ref: 00007FF71576ABD0

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 82bbaa7e25dd18572a77960381fc20bfb2e913c24b3389073f86db474e5ce964
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: FD21A711B18E4285FA597766949637D92829F8CFB0F884335DA2E477F1CFACE44D4321

Function 00007FF71576BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71576BED4

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: f988c549debb264aebf57bddd41e678aa1c397bac0e4db74ca2fb379aa6f2d7b
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 1F41CB72508A4287F638AA19A552179B760EB5EF60F940731D68E436F1CF6CE40ECB61

Function 00007FFDA35FEDB0 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

BUF_MEM_grow_clean.LIBCRYPTO-3(?,?,?,FFFFFFFF,00000000,?,00007FFDA35FF3FE), ref: 00007FFDA35FEE57

Memory Dump Source

Source File: 00000002.00000002.3413120619.00007FFDA35A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDA35A0000, based on PE: true

Associated: 00000002.00000002.3413103779.00007FFDA35A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413120619.00007FFDA3623000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413218182.00007FFDA364D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3652000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3658000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda35a0000_user.jbxd

Similarity

API ID: M_grow_clean
String ID:
API String ID: 964628749-0
Opcode ID: 1aa8bc403af585d6ad140d3c981c2ccf0944b06950901931b16cc14dda0e7e7d
Instruction ID: 1f4496e83eb21bf90dbba501657f70050e8a05dad066d1105e3d595bae885172
Opcode Fuzzy Hash: 1aa8bc403af585d6ad140d3c981c2ccf0944b06950901931b16cc14dda0e7e7d
Instruction Fuzzy Hash: F8416332B0B68686EB659F2ED4603792792EF44B88F184135CE4D67BDACF3AE445C704

Function 00007FF715757F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF71575803A

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 479405c7ef634ee4bdd4ed85459738d9743f05c8c4b8da07aaad499d404441fa
Instruction ID: 7e2456edbcaa2c0e1db52e864ee5f3fa5b9404af8a86e3f93292b7b76213e11e
Opcode Fuzzy Hash: 479405c7ef634ee4bdd4ed85459738d9743f05c8c4b8da07aaad499d404441fa
Instruction Fuzzy Hash: CB21A221B28A5246FA58BB2268063BAD661BF49FE4FD84430EE0C07796DF7DE44DC610

Function 00007FF71576B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71576B9C2

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: 5316b1cc700f6640526cbd04f24842188d81d1ae4773c52822824467b64c0e0b
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: 2B317E22A18E0285F6197B65888637CAA91AF89FB4FC50335E95D033E2CF7CE44D8735

Function 00007FFDA367837C Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FFDA3678401

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Arg_KeywordsUnpack
String ID:
API String ID: 1409375599-0
Opcode ID: 9f51ded2636a1b60185b38b6805e58519e1da1b2f93d7ffa2b68f717ee703bcd
Instruction ID: 89ea139c1a2c46ce7db572be9d0fb04a8c7dbb5feeab183ca51c967692a03984
Opcode Fuzzy Hash: 9f51ded2636a1b60185b38b6805e58519e1da1b2f93d7ffa2b68f717ee703bcd
Instruction Fuzzy Hash: B221E122B0B75181FE50CF42A82196967A5BF49BD0F9D1031EE0C6779ADF7EE841C714

Function 00007FFDA35A1F4B Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFDA35B06DB

Memory Dump Source

Source File: 00000002.00000002.3413120619.00007FFDA35A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDA35A0000, based on PE: true

Associated: 00000002.00000002.3413103779.00007FFDA35A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413120619.00007FFDA3623000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413218182.00007FFDA364D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3652000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3658000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda35a0000_user.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: ffacaa01b585c98eff8cdd5f9400095c95a35eb81919e94f401bdac9d3660e46
Instruction ID: 8b584c9be77c8bc183931a0b9959f8a762c566e55ccd676116e6d9489a506e3a
Opcode Fuzzy Hash: ffacaa01b585c98eff8cdd5f9400095c95a35eb81919e94f401bdac9d3660e46
Instruction Fuzzy Hash: F621A532709B8486E7508F65E450BDAB7A1FB85B88F484036EF8C4BB8ACF3DC5408B44

Function 00007FF715765F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715765EF9

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: fc810e50a3de8c1f194e98b5b8a55674f8e95d62b1e9fa2e35ac3f7676258c23
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 6D118471A1CE4381FA68BF1194121BDE660BF89FA4FC84631EA4C57AA6CF7DD40C5720

Function 00007FF715776354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715776377

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 0393d2871f32812d5bd31af023325b106c7f666b914815afbad5d6f85476cc6d
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 7021C872608E4286E765AF18E445379B7A0FB88F64F944234E65D476E9DF3CD40DCB10

Function 00007FF7157603BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF715760410

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 433361a63adba0e70b79e714af6a42f6ac308644b41dc0124269a5e52f7533b0
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 9A018261A08B4181F919BB529902079EAA1BF8AFF0F884771DE5C13BE6CF3CD4098310

Function 00007FFDA35A1D48 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFDA35FF678

Memory Dump Source

Source File: 00000002.00000002.3413120619.00007FFDA35A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FFDA35A0000, based on PE: true

Associated: 00000002.00000002.3413103779.00007FFDA35A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413120619.00007FFDA3623000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413193437.00007FFDA3625000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413218182.00007FFDA364D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3652000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3658000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.3413238640.00007FFDA3660000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda35a0000_user.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: c921bd486a97e7f46db7fcb7af9098ff3867d55a4c011b1e5539e085f49d76b1
Instruction ID: a767b8df3bd393fd6983c80275bc1352c57f4412e953f0404e9e86b3ea3ed51a
Opcode Fuzzy Hash: c921bd486a97e7f46db7fcb7af9098ff3867d55a4c011b1e5539e085f49d76b1
Instruction Fuzzy Hash: 39E0DFA2F0600242F3211BB8A8567691290DB88714FA81030EA0C96FC3DAAED8E28608

Function 00007FF715758E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF715759390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7157545F4,00000000,00007FF715751985), ref: 00007FF7157593C9

LoadLibraryExW.KERNEL32(?,00007FF715756476,?,00007FF71575336E), ref: 00007FF715758EA2

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction ID: b105e21eec28cbf027334cbeb914167722e607b4ded995152a0d2426cf26ef8f
Opcode Fuzzy Hash: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction Fuzzy Hash: ABD08601B3454541EA48B767B54767592526B8DFD0F888035EE0D03759DE3CC0494700

Function 00007FF71576D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF715760C90,?,?,?,00007FF7157622FA,?,?,?,?,?,00007FF715763AE9), ref: 00007FF71576D63A

Memory Dump Source

Source File: 00000002.00000002.3410704832.00007FF715751000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF715750000, based on PE: true

Associated: 00000002.00000002.3410690573.00007FF715750000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410728111.00007FF71577B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF71578E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410748924.00007FF715791000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3410783363.00007FF715794000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff715750000_user.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 59abf85f6e0639e47eef4be6b46e80c05b432bebf62ecd81e7a291adecdf0d50
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 42F0DA50E29A4645FE5D7A71585B6B592905F8CFF4F884730D92E852E1EF2CA4CC8630

Non-executed Functions

Function 00007FFDA3678734 Relevance: 107.1, APIs: 50, Strings: 11, Instructions: 305COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON313 ref: 00007FFDA3678751
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFDA3678774
PyLong_FromLong.PYTHON313 ref: 00007FFDA367877C
PyDict_SetItemString.PYTHON313 ref: 00007FFDA367879B
_Py_Dealloc.PYTHON313 ref: 00007FFDA36787B1
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFDA36787CD
PyLong_FromLong.PYTHON313 ref: 00007FFDA36787D5
PyDict_SetItemString.PYTHON313 ref: 00007FFDA36787F4
_Py_Dealloc.PYTHON313 ref: 00007FFDA367880A
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFDA3678826
PyLong_FromLong.PYTHON313 ref: 00007FFDA367882E
PyDict_SetItemString.PYTHON313 ref: 00007FFDA367884D
_Py_Dealloc.PYTHON313 ref: 00007FFDA3678863
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFDA367887F
PyLong_FromLong.PYTHON313 ref: 00007FFDA3678887
PyDict_SetItemString.PYTHON313 ref: 00007FFDA36788A6
_Py_Dealloc.PYTHON313 ref: 00007FFDA36788BC
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFDA36788D8
PyLong_FromLong.PYTHON313 ref: 00007FFDA36788E0
PyDict_SetItemString.PYTHON313 ref: 00007FFDA36788FF
_Py_Dealloc.PYTHON313 ref: 00007FFDA3678915
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFDA3678931
PyLong_FromLong.PYTHON313 ref: 00007FFDA3678939
PyDict_SetItemString.PYTHON313 ref: 00007FFDA3678958
_Py_Dealloc.PYTHON313 ref: 00007FFDA367896E
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFDA367898A
PyLong_FromLong.PYTHON313 ref: 00007FFDA3678992
PyDict_SetItemString.PYTHON313 ref: 00007FFDA36789B1
_Py_Dealloc.PYTHON313 ref: 00007FFDA36789C7
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFDA36789E3
PyLong_FromLong.PYTHON313 ref: 00007FFDA36789EB
PyDict_SetItemString.PYTHON313 ref: 00007FFDA3678A0A
_Py_Dealloc.PYTHON313 ref: 00007FFDA3678A20
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFDA3678A3C
PyLong_FromLong.PYTHON313 ref: 00007FFDA3678A44
PyDict_SetItemString.PYTHON313 ref: 00007FFDA3678A63
_Py_Dealloc.PYTHON313 ref: 00007FFDA3678A79
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFDA3678A95
PyLong_FromLong.PYTHON313 ref: 00007FFDA3678A9D
PyDict_SetItemString.PYTHON313 ref: 00007FFDA3678ABC
_Py_Dealloc.PYTHON313 ref: 00007FFDA3678AD2
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFDA3678AEE
PyLong_FromLong.PYTHON313 ref: 00007FFDA3678AF6
PyDict_SetItemString.PYTHON313 ref: 00007FFDA3678B15
_Py_Dealloc.PYTHON313 ref: 00007FFDA3678B2B
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFDA3678B43
PyLong_FromLong.PYTHON313 ref: 00007FFDA3678B4B
PyDict_SetItemString.PYTHON313 ref: 00007FFDA3678B66
_Py_Dealloc.PYTHON313 ref: 00007FFDA3678B7C
_Py_Dealloc.PYTHON313 ref: 00007FFDA3678B99

Strings

connect_good, xrefs: 00007FFDA3678843
hits, xrefs: 00007FFDA3678A59
accept_good, xrefs: 00007FFDA367894E
connect_renegotiate, xrefs: 00007FFDA367889C
connect, xrefs: 00007FFDA36787EA
number, xrefs: 00007FFDA3678791
accept_renegotiate, xrefs: 00007FFDA36789A7
cache_full, xrefs: 00007FFDA3678B5C
timeouts, xrefs: 00007FFDA3678B0B
misses, xrefs: 00007FFDA3678AB2
accept, xrefs: 00007FFDA36788F5, 00007FFDA3678A00

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: DeallocDict_$FromItemLongLong_StringX_ctrl
String ID: accept$accept_good$accept_renegotiate$cache_full$connect$connect_good$connect_renegotiate$hits$misses$number$timeouts
API String ID: 3804526530-4076585280
Opcode ID: 826cc633f0df1c29b54c58aed192b4fcd1af314ebf4e90206c7a0cc2b7cb7904
Instruction ID: 285b81d2067cb6561542440accbbccaf4d50ccc419c53a1bf3c77d0889a70d5c
Opcode Fuzzy Hash: 826cc633f0df1c29b54c58aed192b4fcd1af314ebf4e90206c7a0cc2b7cb7904
Instruction Fuzzy Hash: EED15475F0B70782FA105F31A5B957937A2AF59B95B8C2830CA1E27752EF3EA4188344

Function 00007FFDA367BF74 Relevance: 56.2, APIs: 29, Strings: 3, Instructions: 219threadCOMMON

Download Yara Rule

APIs

_PyObject_GC_New.PYTHON313(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C012
ERR_clear_error.LIBCRYPTO-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C055
PyEval_SaveThread.PYTHON313(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C05B
SSL_new.LIBSSL-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C067
PyEval_RestoreThread.PYTHON313(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C074
_Py_Dealloc.PYTHON313(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C091
SSL_set_session_id_context.LIBSSL-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C0C1
SSL_get0_param.LIBSSL-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C0CB
X509_VERIFY_PARAM_set_hostflags.LIBCRYPTO-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C0D8
SSL_set_ex_data.LIBSSL-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C0E7
SSL_set_fd.LIBSSL-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C0FA
BIO_up_ref.LIBCRYPTO-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C10E
BIO_up_ref.LIBCRYPTO-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C120
SSL_set_bio.LIBSSL-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C132
SSL_ctrl.LIBSSL-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C14C
SSL_get_verify_mode.LIBSSL-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C160
SSL_set_verify.LIBSSL-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C177
SSL_set_post_handshake_auth.LIBSSL-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C181
SSL_get_rbio.LIBSSL-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C1AE
BIO_ctrl.LIBCRYPTO-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C1C3
SSL_get_wbio.LIBSSL-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C1CD
BIO_ctrl.LIBCRYPTO-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C1DE
PyEval_SaveThread.PYTHON313(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C1E4
SSL_set_connect_state.LIBSSL-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C1F5
SSL_set_accept_state.LIBSSL-3(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C1FD
PyEval_RestoreThread.PYTHON313(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C206
PyWeakref_NewRef.PYTHON313(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C219
_Py_Dealloc.PYTHON313(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C267
PyObject_GC_Track.PYTHON313(?,?,00007FFD947961F0,?,?,?,00000000,00007FFDA3677459), ref: 00007FFDA367C29E

Strings

Cannot create a server socket with a PROTOCOL_TLS_CLIENT context, xrefs: 00007FFDA367BFBC
Python, xrefs: 00007FFDA367C0BA
Cannot create a client socket with a PROTOCOL_TLS_SERVER context, xrefs: 00007FFDA367C001

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Eval_Thread$DeallocO_ctrlO_up_refObject_RestoreSave$L_ctrlL_get0_paramL_get_rbioL_get_verify_modeL_get_wbioL_newL_set_accept_stateL_set_bioL_set_connect_stateL_set_ex_dataL_set_fdL_set_post_handshake_authL_set_session_id_contextL_set_verifyM_set_hostflagsR_clear_errorTrackWeakref_X509_
String ID: Cannot create a client socket with a PROTOCOL_TLS_SERVER context$Cannot create a server socket with a PROTOCOL_TLS_CLIENT context$Python
API String ID: 2682668916-1888807747
Opcode ID: cd1b8ea646ef9afa8d9b55c550e8d37b12c63986d5a7a861df86a7bcf2bbbd8b
Instruction ID: 9858197f13a8e634cf1a1df789f813013a9b809522ef75dde974d3a7569d92db
Opcode Fuzzy Hash: cd1b8ea646ef9afa8d9b55c550e8d37b12c63986d5a7a861df86a7bcf2bbbd8b
Instruction Fuzzy Hash: 9FA17235B0A64283FA60DF22E4645397362FF45B84B986535CE4E13B62DF3EE449C748

Function 00007FFDA3548D60 Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3548DAB
PyErr_Clear.PYTHON313 ref: 00007FFDA3548DB9
PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3548DD1
PyErr_Clear.PYTHON313 ref: 00007FFDA3548DDF
PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3548E24
PySequence_Check.PYTHON313 ref: 00007FFDA3548E32
PyErr_SetString.PYTHON313 ref: 00007FFDA3548E4D
PySequence_Size.PYTHON313 ref: 00007FFDA3548E5E
PySequence_Tuple.PYTHON313 ref: 00007FFDA3548E7A
PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3548ED0
_Py_Dealloc.PYTHON313 ref: 00007FFDA3548EE6
AllocateAndInitializeSid.ADVAPI32 ref: 00007FFDA3548F37

Part of subcall function 00007FFDA354E768: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354E782

Part of subcall function 00007FFDA3549550: _Py_NewReference.PYTHON313 ref: 00007FFDA3549570
Part of subcall function 00007FFDA3549550: GetLengthSid.ADVAPI32 ref: 00007FFDA3549579
Part of subcall function 00007FFDA3549550: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3549583
Part of subcall function 00007FFDA3549550: CopySid.ADVAPI32 ref: 00007FFDA3549595

PyErr_SetString.PYTHON313 ref: 00007FFDA3548F8B
_Py_NewReference.PYTHON313 ref: 00007FFDA3548FBC
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3548FC5
memset.VCRUNTIME140 ref: 00007FFDA3548FDC

Strings

(bbbbbb)O:SID, xrefs: 00007FFDA3548E0B
sub authorities sequence size must be <= 8, xrefs: 00007FFDA3548E6D
sub authorities must be a sequence of integers., xrefs: 00007FFDA3548E3C
s#:SID, xrefs: 00007FFDA3548DCA
AllocateAndInitializeSid, xrefs: 00007FFDA3548F43
|n:SID, xrefs: 00007FFDA3548DA4
SID buffer size beyond INT_MAX, xrefs: 00007FFDA3548F81
|llllllll:SID, xrefs: 00007FFDA3548EAE

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Tuple$Arg_Err_Parse$Sequence_malloc$ClearReferenceString$AllocateCheckCopyDeallocInitializeLengthSizememset
String ID: (bbbbbb)O:SID$AllocateAndInitializeSid$SID buffer size beyond INT_MAX$s#:SID$sub authorities must be a sequence of integers.$sub authorities sequence size must be <= 8$|llllllll:SID$|n:SID
API String ID: 2352083970-3682999398
Opcode ID: 020ee9fc2ce227d5ea7689a31ee209964d0e18efe041a45036f0acedb8e9d53f
Instruction ID: dca025a945a8cd2b415c9c5953b651e6e8b7d688cfc488acc792b468a93c73ad
Opcode Fuzzy Hash: 020ee9fc2ce227d5ea7689a31ee209964d0e18efe041a45036f0acedb8e9d53f
Instruction Fuzzy Hash: 75817732B0AB4299EB15CF29E4502AD33A6FB48788F404135EA4E67B59EF3EE514C744

Function 00007FFDA3547EB0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 130COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3547EEC
PyErr_SetString.PYTHON313 ref: 00007FFDA3547F26
GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FFDA3547F6A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3547F82
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FFDA3547F95
GetSecurityDescriptorOwner.ADVAPI32 ref: 00007FFDA3547FE8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3547FFB
GetSecurityDescriptorGroup.ADVAPI32 ref: 00007FFDA354800C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354801F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3548030
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3548046

Part of subcall function 00007FFDA3547950: IsValidSecurityDescriptor.ADVAPI32(?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA3547960
Part of subcall function 00007FFDA3547950: PyErr_SetString.PYTHON313(?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354797B

Part of subcall function 00007FFDA3547D20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D3B
Part of subcall function 00007FFDA3547D20: GetSecurityDescriptorLength.ADVAPI32(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D44

Strings

iOi:SetSecurityDescriptorDacl, xrefs: 00007FFDA3547EE3
SetSecurityDescriptorDacl, xrefs: 00007FFDA3547FA1
The object is not a PyACL object, xrefs: 00007FFDA3547F1C

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: DescriptorSecurityfree$DaclErr_String$Arg_GroupLengthOwnerParseTupleValid
String ID: SetSecurityDescriptorDacl$The object is not a PyACL object$iOi:SetSecurityDescriptorDacl
API String ID: 1359849467-4100764314
Opcode ID: c69bcfbae6702bafd583d989010392b99e7b92f64845daa9d82c487b6be77957
Instruction ID: 20d6d51fd91938ca8dc8bfea9a4be4339e95abcae331f4ead69e44a84e96dcdb
Opcode Fuzzy Hash: c69bcfbae6702bafd583d989010392b99e7b92f64845daa9d82c487b6be77957
Instruction Fuzzy Hash: 4E518022F1A70295EF1A8F69E8601B827A3BF44BC4B444431DD2E67B56DF3EE545C308

Function 00007FFDA36753DC Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA3672358: OBJ_obj2txt.LIBCRYPTO-3 ref: 00007FFDA367239D
Part of subcall function 00007FFDA3672358: PyUnicode_FromStringAndSize.PYTHON313 ref: 00007FFDA36723C3

ASN1_STRING_type.LIBCRYPTO-3(?,?,?,?,?,?,00000000,00007FFDA36752B1), ref: 00007FFDA3675420
ASN1_STRING_length.LIBCRYPTO-3(?,?,?,?,?,?,00000000,00007FFDA36752B1), ref: 00007FFDA367542E
ASN1_STRING_get0_data.LIBCRYPTO-3(?,?,?,?,?,?,00000000,00007FFDA36752B1), ref: 00007FFDA367543A
Py_BuildValue.PYTHON313(?,?,?,?,?,?,00000000,00007FFDA36752B1), ref: 00007FFDA3675450

Part of subcall function 00007FFDA3676750: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFDA3676768
Part of subcall function 00007FFDA3676750: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA3676791

Strings

D:\a\1\s\Modules\_ssl.c, xrefs: 00007FFDA36754BE
Ns#, xrefs: 00007FFDA36754A9
Ny#, xrefs: 00007FFDA3675443

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: BuildFromG_get0_dataG_lengthG_typeJ_obj2txtR_clear_errorR_peek_last_errorSizeStringUnicode_Value
String ID: D:\a\1\s\Modules\_ssl.c$Ns#$Ny#
API String ID: 3688187681-3706530764
Opcode ID: a56e385dd9f82a97b731b3bd318fa4146ccdbce11f56f854f3cbde2209290979
Instruction ID: 7d29b6ff1b5d17339dd4ddfe77deb1fb8e47fcdf719ba7b2edddf0d5a069f1cc
Opcode Fuzzy Hash: a56e385dd9f82a97b731b3bd318fa4146ccdbce11f56f854f3cbde2209290979
Instruction Fuzzy Hash: DB21B461B1E74282FB108B12A5643796352AF45BC5F8C6430DE0E67B5BEF3DE0458718

Function 00007FFDA354FA14 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDA354FA30
memset.VCRUNTIME140 ref: 00007FFDA354FA54
RtlCaptureContext.KERNEL32 ref: 00007FFDA354FA5D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDA354FA77
RtlVirtualUnwind.KERNEL32 ref: 00007FFDA354FAB8
memset.VCRUNTIME140 ref: 00007FFDA354FAEB
IsDebuggerPresent.KERNEL32 ref: 00007FFDA354FB0C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDA354FB2D
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDA354FB38

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: a77b7a5226053fc0ebc07969f81f816b5156b1559ac007c1bd8a292e365ebe04
Instruction ID: 48809fd3388df1505a8892dc6a952f204740b36d663c432e193c099d371a67bf
Opcode Fuzzy Hash: a77b7a5226053fc0ebc07969f81f816b5156b1559ac007c1bd8a292e365ebe04
Instruction Fuzzy Hash: 9731B47270AB8186EB658FA9E8603ED7362FB84744F40403ADA4E57B95DF3DD248C718

Function 00007FFDA367339C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDA36733B8
memset.VCRUNTIME140 ref: 00007FFDA36733DC
RtlCaptureContext.KERNEL32 ref: 00007FFDA36733E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDA36733FF
RtlVirtualUnwind.KERNEL32 ref: 00007FFDA3673440
memset.VCRUNTIME140 ref: 00007FFDA3673473
IsDebuggerPresent.KERNEL32 ref: 00007FFDA3673494
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDA36734B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDA36734BC

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 8e86fcbda8d44a87da12ad3cbe0ff2274eff02410a8037cee209cf92a2e866f6
Instruction ID: 5f99acd5d558959b9931b21ca51331ed90805f4a79ed4d31213d99595a8606ad
Opcode Fuzzy Hash: 8e86fcbda8d44a87da12ad3cbe0ff2274eff02410a8037cee209cf92a2e866f6
Instruction Fuzzy Hash: 50316D72709B8186FB608F60E8503ED7365FB84708F88543ADA4E67B99EF39C548C714

Function 00007FFDA354D6E0 Relevance: 80.7, APIs: 33, Strings: 13, Instructions: 201threadmemoryCOMMON

Download Yara Rule

APIs

PyThreadState_Swap.PYTHON313 ref: 00007FFDA354D6F0
_Py_FatalErrorFunc.PYTHON313 ref: 00007FFDA354D70C
PyThreadState_Swap.PYTHON313 ref: 00007FFDA354D71E
LocalAlloc.KERNEL32 ref: 00007FFDA354D731
_Py_FatalErrorFunc.PYTHON313 ref: 00007FFDA354D74D
TlsSetValue.KERNEL32 ref: 00007FFDA354D762
PyThreadState_Swap.PYTHON313 ref: 00007FFDA354D76A
PyThreadState_Swap.PYTHON313 ref: 00007FFDA354D776
PyDict_New.PYTHON313 ref: 00007FFDA354D791
PyUnicode_DecodeMBCS.PYTHON313 ref: 00007FFDA354D7B2
_Py_Dealloc.PYTHON313 ref: 00007FFDA354D7CD
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354D7FB
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354D80E
_Py_Dealloc.PYTHON313 ref: 00007FFDA354D822
PyImport_ImportModule.PYTHON313 ref: 00007FFDA354D82F
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354D84A
_Py_Dealloc.PYTHON313 ref: 00007FFDA354D868
PyRun_StringFlags.PYTHON313 ref: 00007FFDA354D889
_Py_Dealloc.PYTHON313 ref: 00007FFDA354D8A6
PyDict_GetItemString.PYTHON313 ref: 00007FFDA354D8B6
PyDict_GetItemString.PYTHON313 ref: 00007FFDA354D8DB
_Py_Dealloc.PYTHON313 ref: 00007FFDA354D904
PyType_Ready.PYTHON313 ref: 00007FFDA354D911
PyType_Ready.PYTHON313 ref: 00007FFDA354D927
PyType_Ready.PYTHON313 ref: 00007FFDA354D93D
PyType_Ready.PYTHON313 ref: 00007FFDA354D953
PyType_Ready.PYTHON313 ref: 00007FFDA354D969
PyType_Ready.PYTHON313 ref: 00007FFDA354D97F
PyType_Ready.PYTHON313 ref: 00007FFDA354D995
PyType_Ready.PYTHON313 ref: 00007FFDA354D9AB
PyType_Ready.PYTHON313 ref: 00007FFDA354D9C1
PyCapsule_Import.PYTHON313 ref: 00007FFDA354D9D9
PyType_Ready.PYTHON313 ref: 00007FFDA354DA31

Strings

Exception, xrefs: 00007FFDA354D7EE
pywintypes: can not setup interpreter state, as current state is invalid, xrefs: 00007FFDA354D6FE
com_error, xrefs: 00007FFDA354D8D1
Out of memory allocating thread state., xrefs: 00007FFDA354D73F
PyWinInterpreterState_Ensure, xrefs: 00007FFDA354D705, 00007FFDA354D746
error, xrefs: 00007FFDA354D8AC
ignore, xrefs: 00007FFDA354D79F
__builtins__, xrefs: 00007FFDA354D840
builtins, xrefs: 00007FFDA354D828
__name__, xrefs: 00007FFDA354D804
class error(Exception): def __init__(self, *args, **kw): nargs = len(args) if nargs > 0: self.winerror = args[0] else: self.winerror = None if nargs > 1: self.funcname = args[1] else: self.funcname = None if nargs > 2: self.strerror =, xrefs: 00007FFDA354D87D
datetime.datetime_CAPI, xrefs: 00007FFDA354D9D2
pywintypes, xrefs: 00007FFDA354D7AB

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: ReadyType_$Dict_String$DeallocItem$State_SwapThread$ErrorFatalFuncImport$AllocCapsule_DecodeFlagsImport_LocalModuleRun_Unicode_Value
String ID: Exception$Out of memory allocating thread state.$PyWinInterpreterState_Ensure$__builtins__$__name__$builtins$class error(Exception): def __init__(self, *args, **kw): nargs = len(args) if nargs > 0: self.winerror = args[0] else: self.winerror = None if nargs > 1: self.funcname = args[1] else: self.funcname = None if nargs > 2: self.strerror =$com_error$datetime.datetime_CAPI$error$ignore$pywintypes$pywintypes: can not setup interpreter state, as current state is invalid
API String ID: 3484552599-1312685011
Opcode ID: 3e559cf5b5cfc2f2b8ba3100ed33c113d64749a0116b8bc114fdaa9902568029
Instruction ID: 930bf9e3ad9c4f0218b5d0b35132b94dcb323f32b4a8816126b9246d0788046c
Opcode Fuzzy Hash: 3e559cf5b5cfc2f2b8ba3100ed33c113d64749a0116b8bc114fdaa9902568029
Instruction Fuzzy Hash: 36A1B734F1AB0281EA0A8B2DE97427927A3BF44B95F444535C91F627A2EF3EF5158708

Function 00007FFDA354DB30 Relevance: 78.9, APIs: 28, Strings: 17, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA354D6E0: PyThreadState_Swap.PYTHON313 ref: 00007FFDA354D6F0
Part of subcall function 00007FFDA354D6E0: _Py_FatalErrorFunc.PYTHON313 ref: 00007FFDA354D70C
Part of subcall function 00007FFDA354D6E0: PyThreadState_Swap.PYTHON313 ref: 00007FFDA354D71E
Part of subcall function 00007FFDA354D6E0: LocalAlloc.KERNEL32 ref: 00007FFDA354D731
Part of subcall function 00007FFDA354D6E0: _Py_FatalErrorFunc.PYTHON313 ref: 00007FFDA354D74D
Part of subcall function 00007FFDA354D6E0: TlsSetValue.KERNEL32 ref: 00007FFDA354D762
Part of subcall function 00007FFDA354D6E0: PyThreadState_Swap.PYTHON313 ref: 00007FFDA354D76A
Part of subcall function 00007FFDA354D6E0: PyThreadState_Swap.PYTHON313 ref: 00007FFDA354D776
Part of subcall function 00007FFDA354D6E0: PyDict_New.PYTHON313 ref: 00007FFDA354D791
Part of subcall function 00007FFDA354D6E0: PyUnicode_DecodeMBCS.PYTHON313 ref: 00007FFDA354D7B2
Part of subcall function 00007FFDA354D6E0: _Py_Dealloc.PYTHON313 ref: 00007FFDA354D7CD

PyModule_Create2.PYTHON313 ref: 00007FFDA354DB54
PyModule_GetDict.PYTHON313 ref: 00007FFDA354DB69
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DBA3
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DBC3
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DBE3
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DC03
PyModule_AddIntConstant.PYTHON313 ref: 00007FFDA354DC22
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DC42
PyType_Ready.PYTHON313 ref: 00007FFDA354DC58
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DC78
PyType_Ready.PYTHON313 ref: 00007FFDA354DC8E
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DCAE
PyType_Ready.PYTHON313 ref: 00007FFDA354DCC4
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DCE4
PyType_Ready.PYTHON313 ref: 00007FFDA354DCFA
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DD1A
PyType_Ready.PYTHON313 ref: 00007FFDA354DD30
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DD50
PyType_Ready.PYTHON313 ref: 00007FFDA354DD66
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DD86
PyType_Ready.PYTHON313 ref: 00007FFDA354DD9C
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DDBC
PyType_Ready.PYTHON313 ref: 00007FFDA354DDD2
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DDF2
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DE0E
PyType_Ready.PYTHON313 ref: 00007FFDA354DE20
PyDict_SetItemString.PYTHON313 ref: 00007FFDA354DE3C
PyErr_SetString.PYTHON313 ref: 00007FFDA354DE66

Strings

FALSE, xrefs: 00007FFDA354DBF9
com_error, xrefs: 00007FFDA354DBB9
TRUE, xrefs: 00007FFDA354DBD9
SIDType, xrefs: 00007FFDA354DD13
WAVEFORMATEXType, xrefs: 00007FFDA354DE35
SECURITY_DESCRIPTORType, xrefs: 00007FFDA354DCA7
WAVE_FORMAT_PCM, xrefs: 00007FFDA354DC18
DEVMODEType, xrefs: 00007FFDA354DE07
error, xrefs: 00007FFDA354DB99
OVERLAPPEDType, xrefs: 00007FFDA354DDB5
IIDType, xrefs: 00007FFDA354DC71
DEVMODEWType, xrefs: 00007FFDA354DDEB
Could not initialise the error objects, xrefs: 00007FFDA354DE5C
HANDLEType, xrefs: 00007FFDA354DD7F
TimeType, xrefs: 00007FFDA354DC3B
ACLType, xrefs: 00007FFDA354DD49
SECURITY_ATTRIBUTESType, xrefs: 00007FFDA354DCDD

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Dict_String$Item$ReadyType_$State_SwapThread$Module_$ErrorFatalFunc$AllocConstantCreate2DeallocDecodeDictErr_LocalUnicode_Value
String ID: ACLType$Could not initialise the error objects$DEVMODEType$DEVMODEWType$FALSE$HANDLEType$IIDType$OVERLAPPEDType$SECURITY_ATTRIBUTESType$SECURITY_DESCRIPTORType$SIDType$TRUE$TimeType$WAVEFORMATEXType$WAVE_FORMAT_PCM$com_error$error
API String ID: 2302314715-313003814
Opcode ID: de223336d6068828db36fb0dc1bb87c70e4bd450320daeffceca65b23cb5c0d5
Instruction ID: 91f4cce5d18871d262c5452ee1e9016b8d781d7d6e3de96ab9e290642863f885
Opcode Fuzzy Hash: de223336d6068828db36fb0dc1bb87c70e4bd450320daeffceca65b23cb5c0d5
Instruction Fuzzy Hash: D391BF60F1AB0291EA068B2DE8741743693AF517A0F940632D42F637F2DF7FF9598648

Function 00007FFDA354E090 Relevance: 77.2, APIs: 25, Strings: 19, Instructions: 225COMMON

Download Yara Rule

APIs

PyImport_ImportModule.PYTHON313 ref: 00007FFDA354E0C7
PyImport_ImportModule.PYTHON313 ref: 00007FFDA354E0E8
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA354E307
_Py_Dealloc.PYTHON313 ref: 00007FFDA354E32B
_Py_Dealloc.PYTHON313 ref: 00007FFDA354E345
_Py_Dealloc.PYTHON313 ref: 00007FFDA354E35E
_Py_Dealloc.PYTHON313 ref: 00007FFDA354E379
_Py_Dealloc.PYTHON313 ref: 00007FFDA354E393
_Py_Dealloc.PYTHON313 ref: 00007FFDA354E3AF
_Py_Dealloc.PYTHON313 ref: 00007FFDA354E3C8
PyMem_Free.PYTHON313 ref: 00007FFDA354E3D6

Strings

traceback, xrefs: 00007FFDA354E0E1
<Error getting traceback - can't import traceback>, xrefs: 00007FFDA354E0F6
<Error getting traceback - can't import cStringIO>, xrefs: 00007FFDA354E0D5
<Error getting traceback - can't find cStringIO.StringIO>, xrefs: 00007FFDA354E11A
Getting WCHAR string, xrefs: 00007FFDA354E290
<Error getting traceback - can't make print_exception arguments>, xrefs: 00007FFDA354E1C9
OOOOOi, xrefs: 00007FFDA354E1B4
<Error getting traceback - getvalue() failed.>, xrefs: 00007FFDA354E252
<Error getting traceback - can't find traceback.print_exception>, xrefs: 00007FFDA354E15D
print_exception, xrefs: 00007FFDA354E145
<Error getting traceback - traceback.print_exception() failed>, xrefs: 00007FFDA354E1E9
<Error getting traceback - getvalue() did not return a string>, xrefs: 00007FFDA354E300
None is not a valid string in this context, xrefs: 00007FFDA354E2C5
StringIO, xrefs: 00007FFDA354E102
<Error getting traceback - can't find getvalue function>, xrefs: 00007FFDA354E220
<Error getting traceback - cStringIO.StringIO() failed>, xrefs: 00007FFDA354E139
getvalue, xrefs: 00007FFDA354E208
Objects of type '%s' can not be converted to Unicode., xrefs: 00007FFDA354E2F0
<NULL!!>, xrefs: 00007FFDA354E2E2

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Dealloc$ImportImport_Module$FreeMem__wcsdup
String ID: <Error getting traceback - cStringIO.StringIO() failed>$<Error getting traceback - can't find cStringIO.StringIO>$<Error getting traceback - can't find getvalue function>$<Error getting traceback - can't find traceback.print_exception>$<Error getting traceback - can't import cStringIO>$<Error getting traceback - can't import traceback>$<Error getting traceback - can't make print_exception arguments>$<Error getting traceback - getvalue() did not return a string>$<Error getting traceback - getvalue() failed.>$<Error getting traceback - traceback.print_exception() failed>$<NULL!!>$Getting WCHAR string$None is not a valid string in this context$OOOOOi$Objects of type '%s' can not be converted to Unicode.$StringIO$getvalue$print_exception$traceback
API String ID: 2735870070-3599414692
Opcode ID: 0043d422bc0162b250e8750caf090f3e3b7605d422a7505aa728d4c321d93bbf
Instruction ID: e4f74ca2cddb772896e7c02bf688620c574d7ec2aa12558e0b6ed11635c414fc
Opcode Fuzzy Hash: 0043d422bc0162b250e8750caf090f3e3b7605d422a7505aa728d4c321d93bbf
Instruction Fuzzy Hash: C2A1F621F0BB4281EE5B8B1AA87827827A3BF54B85F445431D90E66796EF3EF504C34C

Function 00007FFDA3677ACC Relevance: 75.5, APIs: 33, Strings: 10, Instructions: 218threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677AF4
PyErr_SetString.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677B16
TLS_server_method.LIBSSL-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677B6D
TLS_client_method.LIBSSL-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677B78
PyErr_WarnEx.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677B97
TLSv1_2_method.LIBSSL-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677BA6
PyErr_WarnEx.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677BC2
TLSv1_1_method.LIBSSL-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677BD1
PyErr_WarnEx.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677BED
TLSv1_method.LIBSSL-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677BFC
PyErr_WarnEx.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677C18
TLS_method.LIBSSL-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677C27
PyErr_Format.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677C49
PyEval_SaveThread.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677C54
SSL_CTX_new.LIBSSL-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677C60
PyEval_RestoreThread.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677C6C
PyModule_GetState.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677C7A
SSL_CTX_free.LIBSSL-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677CB1
PyModule_GetState.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677CE1
_Py_Dealloc.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677D25
SSL_CTX_set_options.LIBSSL-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677D4C
SSL_CTX_set_cipher_list.LIBSSL-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677D67
ERR_clear_error.LIBCRYPTO-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677D71
PyErr_SetString.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677D86
SSL_CTX_ctrl.LIBSSL-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677DAF
PyErr_Format.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677DCD
_Py_Dealloc.PYTHON313(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677DE1
ERR_clear_error.LIBCRYPTO-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677DE7
SSL_CTX_ctrl.LIBSSL-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677E01
SSL_CTX_get0_param.LIBSSL-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677E0B
X509_VERIFY_PARAM_set_flags.LIBCRYPTO-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677E1C
X509_VERIFY_PARAM_set_hostflags.LIBCRYPTO-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677E28
SSL_CTX_set_post_handshake_auth.LIBSSL-3(?,?,?,?,00000000,00007FFDA36770DB), ref: 00007FFDA3677E38

Strings

ssl.PROTOCOL_TLSv1_1 is deprecated, xrefs: 00007FFDA3677BB5
Cannot find internal module state, xrefs: 00007FFDA3677B0C
No cipher can be selected., xrefs: 00007FFDA3677D7B
ssl.PROTOCOL_TLSv1_2 is deprecated, xrefs: 00007FFDA3677B8A
HIGH:!aNULL:!eNULL, xrefs: 00007FFDA3677D60
invalid or unsupported protocol version %i, xrefs: 00007FFDA3677C3C
@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM, xrefs: 00007FFDA3677D52
ssl.PROTOCOL_TLS is deprecated, xrefs: 00007FFDA3677C0B
Failed to set minimum protocol 0x%x, xrefs: 00007FFDA3677DC0
ssl.PROTOCOL_TLSv1 is deprecated, xrefs: 00007FFDA3677BE0

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Err_$Warn$DeallocEval_FormatModule_R_clear_errorStateStringThreadX509_X_ctrl$M_set_flagsM_set_hostflagsModuleRestoreS_client_methodS_methodS_server_methodSaveSv1_1_methodSv1_2_methodSv1_methodType_X_freeX_get0_paramX_newX_set_cipher_listX_set_optionsX_set_post_handshake_auth
String ID: @SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM$Cannot find internal module state$Failed to set minimum protocol 0x%x$HIGH:!aNULL:!eNULL$No cipher can be selected.$invalid or unsupported protocol version %i$ssl.PROTOCOL_TLS is deprecated$ssl.PROTOCOL_TLSv1 is deprecated$ssl.PROTOCOL_TLSv1_1 is deprecated$ssl.PROTOCOL_TLSv1_2 is deprecated
API String ID: 2858978057-3426422906
Opcode ID: 48bebc18205c76d80cab5c4d01de1e3ce84cc258928a9eb230b2610426a1f973
Instruction ID: 03fa866f89f34f4d32df770a5b2b66b404691458e425336ac701c45cdf518d32
Opcode Fuzzy Hash: 48bebc18205c76d80cab5c4d01de1e3ce84cc258928a9eb230b2610426a1f973
Instruction Fuzzy Hash: 97A16335B0AA0283FA549F25E97807837A2FF45B94F986531C91E67762DF3EE458C308

Function 00007FFDA3677F2C Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 206threadCOMMON

Download Yara Rule

APIs

SSL_CTX_get_default_passwd_cb.LIBSSL-3 ref: 00007FFDA3677F5E
SSL_CTX_get_default_passwd_cb_userdata.LIBSSL-3 ref: 00007FFDA3677F6B
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3677F84
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA3677F8D
PyUnicode_FSConverter.PYTHON313 ref: 00007FFDA3677FA5
PyErr_ExceptionMatches.PYTHON313 ref: 00007FFDA3677FB9
PyErr_SetString.PYTHON313 ref: 00007FFDA3677FD4

Part of subcall function 00007FFDA3676374: PyUnicode_AsUTF8String.PYTHON313(?,?,?,00007FFDA36762E0), ref: 00007FFDA36763A4
Part of subcall function 00007FFDA3676374: PyErr_Format.PYTHON313(?,?,?,00007FFDA36762E0), ref: 00007FFDA3676419
Part of subcall function 00007FFDA3676374: _Py_Dealloc.PYTHON313(?,?,?,00007FFDA36762E0), ref: 00007FFDA3676467

Part of subcall function 00007FFDA3676750: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFDA3676768
Part of subcall function 00007FFDA3676750: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA3676791

PyUnicode_FSConverter.PYTHON313 ref: 00007FFDA3677FED
PyErr_ExceptionMatches.PYTHON313 ref: 00007FFDA3678001
PyErr_SetString.PYTHON313 ref: 00007FFDA3678020
PyCallable_Check.PYTHON313 ref: 00007FFDA3678037
SSL_CTX_set_default_passwd_cb.LIBSSL-3 ref: 00007FFDA367806D
SSL_CTX_set_default_passwd_cb_userdata.LIBSSL-3 ref: 00007FFDA367807B
PyEval_SaveThread.PYTHON313 ref: 00007FFDA3678081
SSL_CTX_use_certificate_chain_file.LIBSSL-3 ref: 00007FFDA3678097
PyEval_RestoreThread.PYTHON313 ref: 00007FFDA36780A3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA36780B8
PyErr_SetFromErrno.PYTHON313 ref: 00007FFDA36780CD
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA36780D3
SSL_CTX_set_default_passwd_cb.LIBSSL-3(?,?,?,?,?,?,00007FFD947961F0,?,00007FFD947961F0,00007FFDA3677F0E), ref: 00007FFDA36781C0
SSL_CTX_set_default_passwd_cb_userdata.LIBSSL-3(?,?,?,?,?,?,00007FFD947961F0,?,00007FFD947961F0,00007FFDA3677F0E), ref: 00007FFDA36781CD
PyMem_Free.PYTHON313(?,?,?,?,?,?,00007FFD947961F0,?,00007FFD947961F0,00007FFDA3677F0E), ref: 00007FFDA36781D7
_Py_Dealloc.PYTHON313(?,?,?,?,?,?,00007FFD947961F0,?,00007FFD947961F0,00007FFDA3677F0E), ref: 00007FFDA36781F1
_Py_Dealloc.PYTHON313(?,?,?,?,?,?,00007FFD947961F0,?,00007FFD947961F0,00007FFDA3677F0E), ref: 00007FFDA3678217
SSL_CTX_set_default_passwd_cb.LIBSSL-3 ref: 00007FFDA3678229
SSL_CTX_set_default_passwd_cb_userdata.LIBSSL-3 ref: 00007FFDA3678236
PyMem_Free.PYTHON313 ref: 00007FFDA3678240

Strings

keyfile should be a valid filesystem path, xrefs: 00007FFDA3678016
certfile should be a valid filesystem path, xrefs: 00007FFDA3677FCA
password should be a string or callable, xrefs: 00007FFDA3678047

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Err_$DeallocR_clear_errorStringUnicode_X_set_default_passwd_cbX_set_default_passwd_cb_userdata$ConverterEval_ExceptionFreeMatchesMem_Thread_errno$Callable_CheckErrnoFormatFromR_peek_last_errorRestoreSaveX_get_default_passwd_cbX_get_default_passwd_cb_userdataX_use_certificate_chain_file
String ID: certfile should be a valid filesystem path$keyfile should be a valid filesystem path$password should be a string or callable
API String ID: 1360066414-998072137
Opcode ID: d7c8620c3b1db992069c4994a0da7375102a158a8bd939964995283b44567453
Instruction ID: 5d790e93217b6b8b08fac3c42f3fd8336f8a771d4e6bf47e705ecf2c631faa54
Opcode Fuzzy Hash: d7c8620c3b1db992069c4994a0da7375102a158a8bd939964995283b44567453
Instruction Fuzzy Hash: 8FA11F35B0AA42C6FB109F61E8640792772FF44B59B9C6431CD0E67B56DF3EE8598308

Function 00007FFDA3672410 Relevance: 64.9, APIs: 18, Strings: 19, Instructions: 124COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON313 ref: 00007FFDA3672422
PyType_FromSpecWithBases.PYTHON313 ref: 00007FFDA367243C
PyModule_AddObjectRef.PYTHON313 ref: 00007FFDA367245C
PyTuple_Pack.PYTHON313 ref: 00007FFDA367247D
PyErr_NewExceptionWithDoc.PYTHON313 ref: 00007FFDA36724A3
PyModule_AddObjectRef.PYTHON313 ref: 00007FFDA36724BA
PyErr_NewExceptionWithDoc.PYTHON313 ref: 00007FFDA36724EC
PyModule_AddObjectRef.PYTHON313 ref: 00007FFDA3672503
PyErr_NewExceptionWithDoc.PYTHON313 ref: 00007FFDA3672526
PyModule_AddObjectRef.PYTHON313 ref: 00007FFDA367253D
PyErr_NewExceptionWithDoc.PYTHON313 ref: 00007FFDA3672560
PyModule_AddObjectRef.PYTHON313 ref: 00007FFDA3672577
PyErr_NewExceptionWithDoc.PYTHON313 ref: 00007FFDA3672596
PyModule_AddObjectRef.PYTHON313 ref: 00007FFDA36725AD
PyErr_NewExceptionWithDoc.PYTHON313 ref: 00007FFDA36725CC
PyModule_AddObjectRef.PYTHON313 ref: 00007FFDA36725E3
_Py_Dealloc.PYTHON313 ref: 00007FFDA3673C5B
_Py_Dealloc.PYTHON313 ref: 00007FFDA3673C7D

Strings

SSLWantReadError, xrefs: 00007FFDA3672566
ssl.SSLWantWriteError, xrefs: 00007FFDA367251F
ssl.SSLCertVerificationError, xrefs: 00007FFDA367249C
SSLSyscallError, xrefs: 00007FFDA367259C
SSLZeroReturnError, xrefs: 00007FFDA36724F2
SSL/TLS connection terminated abruptly., xrefs: 00007FFDA36725BB
ssl.SSLSyscallError, xrefs: 00007FFDA367258F
ssl.SSLEOFError, xrefs: 00007FFDA36725C5
SSLWantWriteError, xrefs: 00007FFDA367252C
ssl.SSLZeroReturnError, xrefs: 00007FFDA36724E5
System error when attempting SSL operation., xrefs: 00007FFDA3672585
SSL/TLS session closed cleanly., xrefs: 00007FFDA36724DB
SSLCertVerificationError, xrefs: 00007FFDA36724A9
ssl.SSLWantReadError, xrefs: 00007FFDA3672559
SSLError, xrefs: 00007FFDA3672452
Non-blocking SSL socket needs to write more databefore the requested operation can be completed., xrefs: 00007FFDA3672515
A certificate could not be verified., xrefs: 00007FFDA3672492
Non-blocking SSL socket needs to read more databefore the requested operation can be completed., xrefs: 00007FFDA367254F
SSLEOFError, xrefs: 00007FFDA36725D2

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Module_$ObjectWith$Err_Exception$Dealloc$BasesFromPackSpecStateTuple_Type_
String ID: A certificate could not be verified.$Non-blocking SSL socket needs to read more databefore the requested operation can be completed.$Non-blocking SSL socket needs to write more databefore the requested operation can be completed.$SSL/TLS connection terminated abruptly.$SSL/TLS session closed cleanly.$SSLCertVerificationError$SSLEOFError$SSLError$SSLSyscallError$SSLWantReadError$SSLWantWriteError$SSLZeroReturnError$System error when attempting SSL operation.$ssl.SSLCertVerificationError$ssl.SSLEOFError$ssl.SSLSyscallError$ssl.SSLWantReadError$ssl.SSLWantWriteError$ssl.SSLZeroReturnError
API String ID: 2091157252-1330971811
Opcode ID: 85c8ea0a4b1603a364a6c51d8a05ef5ffe5e52dbd55a1fbedf1c68b2a8ea180a
Instruction ID: 8e14ec46f864f348fcff936ce1c671fd600b53565e87f2d951610877ef213c9f
Opcode Fuzzy Hash: 85c8ea0a4b1603a364a6c51d8a05ef5ffe5e52dbd55a1fbedf1c68b2a8ea180a
Instruction Fuzzy Hash: 76512F71B0AB4381FB109F15F87456527A7BF09B84B987036C90D6BB66EF2EE158C348

Function 00007FFDA3542600 Relevance: 49.2, APIs: 14, Strings: 14, Instructions: 175COMMON

Download Yara Rule

APIs

GetExplicitEntriesFromAclW.ADVAPI32 ref: 00007FFDA3542623
PyTuple_New.PYTHON313 ref: 00007FFDA3542651
PyErr_SetString.PYTHON313 ref: 00007FFDA35426FB
Py_BuildValue.PYTHON313 ref: 00007FFDA354287C
PyTuple_SetItem.PYTHON313 ref: 00007FFDA3542890
LocalFree.KERNEL32 ref: 00007FFDA3542908

Part of subcall function 00007FFDA354C400: GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C41B
Part of subcall function 00007FFDA354C400: FormatMessageW.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C48A
Part of subcall function 00007FFDA354C400: PyUnicode_DecodeMBCS.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C568
Part of subcall function 00007FFDA354C400: Py_BuildValue.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C57D
Part of subcall function 00007FFDA354C400: LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C595
Part of subcall function 00007FFDA354C400: PyErr_SetObject.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C5AA

Strings

GetExplicitEntriesFromAcl, xrefs: 00007FFDA354262F
TrusteeForm, xrefs: 00007FFDA354269F, 00007FFDA35427DE, 00007FFDA35428AB
TrusteeType, xrefs: 00007FFDA3542690, 00007FFDA35427E5, 00007FFDA35428A4
{s:l,s:l,s:l,s:N}, xrefs: 00007FFDA3542860
Identifier, xrefs: 00007FFDA3542681, 00007FFDA35427EC, 00007FFDA354289A
Inheritance, xrefs: 00007FFDA35426AB, 00007FFDA35427D7
{s:O,s:l,s:l,s:l,s:N}, xrefs: 00007FFDA3542800
TrusteeForm not yet supported, xrefs: 00007FFDA3542710
AccessPermissions, xrefs: 00007FFDA3542856
MultipleTrusteeOperation, xrefs: 00007FFDA3542834
MultipleTrustee, xrefs: 00007FFDA3542811
Invalid value for TrusteeForm, xrefs: 00007FFDA35426F1
Trustee, xrefs: 00007FFDA35426BA
AccessMode, xrefs: 00007FFDA354284A

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: BuildErr_FreeLocalTuple_Value$DecodeEntriesErrorExplicitFormatFromItemLastMessageObjectStringUnicode_
String ID: AccessMode$AccessPermissions$GetExplicitEntriesFromAcl$Identifier$Inheritance$Invalid value for TrusteeForm$MultipleTrustee$MultipleTrusteeOperation$Trustee$TrusteeForm$TrusteeForm not yet supported$TrusteeType${s:O,s:l,s:l,s:l,s:N}${s:l,s:l,s:l,s:N}
API String ID: 1576682769-3224252679
Opcode ID: 5a51bc5ec4fdc2f2b2449b67a7b18b879f8b3dee29234ec28016f6faf2fd6655
Instruction ID: b131e4b6819a81b3c67ca6a482e9ef54fa15c0b2c0e3101445e58c707e2612ae
Opcode Fuzzy Hash: 5a51bc5ec4fdc2f2b2449b67a7b18b879f8b3dee29234ec28016f6faf2fd6655
Instruction Fuzzy Hash: 02915D35B0AB4286EA26CF19F46026977A2FB44B90F444035CA4E63B66DF3EF549C708

Function 00007FFDA354A0B0 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 207COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON313 ref: 00007FFDA354A0E8
PyObject_GetAttrString.PYTHON313 ref: 00007FFDA354A11D
PyErr_Clear.PYTHON313 ref: 00007FFDA354A12B

Part of subcall function 00007FFDA354A720: Py_BuildValue.PYTHON313(?,?,00000000,00007FFDA354A1B2), ref: 00007FFDA354A72F

PyObject_CallObject.PYTHON313 ref: 00007FFDA354A138
_Py_Dealloc.PYTHON313 ref: 00007FFDA354A14E
PyNumber_Check.PYTHON313 ref: 00007FFDA354A163
PyNumber_Long.PYTHON313 ref: 00007FFDA354A170
PyLong_AsLong.PYTHON313 ref: 00007FFDA354A185
PyErr_Occurred.PYTHON313 ref: 00007FFDA354A190
PyErr_BadArgument.PYTHON313 ref: 00007FFDA354A19F
_Py_Dealloc.PYTHON313 ref: 00007FFDA354A2B0
_mktime64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFDA354A2BE
PyErr_SetString.PYTHON313 ref: 00007FFDA354A2DB
PyErr_SetString.PYTHON313 ref: 00007FFDA354A332
_Py_Dealloc.PYTHON313 ref: 00007FFDA354A3A1
PyErr_Format.PYTHON313 ref: 00007FFDA354A3C2
_Py_Dealloc.PYTHON313 ref: 00007FFDA354A3DC

Strings

(d), xrefs: 00007FFDA354A342
timetuple, xrefs: 00007FFDA354A0FE
year out of range, xrefs: 00007FFDA354A328
mktime argument out of range, xrefs: 00007FFDA354A2D1
iiiiiiiii|i, xrefs: 00007FFDA354A1F6
Objects of type '%s' can not be used as a time object, xrefs: 00007FFDA354A3AD

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$Dealloc$String$LongNumber_Object_$ArgumentAttrBuildCallCheckClearFormatLong_ObjectOccurredSubtypeType_Value_mktime64
String ID: (d)$Objects of type '%s' can not be used as a time object$iiiiiiiii|i$mktime argument out of range$timetuple$year out of range
API String ID: 3975405178-3179837657
Opcode ID: 3ef851e5d06e54bdc5a790e60f5679cb7fcdb0b9f7579482d87791eaca5b7d75
Instruction ID: abdc169efdbcea8e25bd5da1d0635ab07705c814fa7d97654ccf3a4e949d1c48
Opcode Fuzzy Hash: 3ef851e5d06e54bdc5a790e60f5679cb7fcdb0b9f7579482d87791eaca5b7d75
Instruction Fuzzy Hash: 81A15F32F0AB4285EB9A8F29D4602B933A2EF44B94F444135D94E66756EF3EF584C708

Function 00007FFDA354DE80 Relevance: 47.4, APIs: 16, Strings: 11, Instructions: 106libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFDA354DE93
LoadLibraryW.KERNEL32 ref: 00007FFDA354DEA8
GetProcAddress.KERNEL32 ref: 00007FFDA354DEC4
GetProcAddress.KERNEL32 ref: 00007FFDA354DEE9
GetProcAddress.KERNEL32 ref: 00007FFDA354DF0E
GetProcAddress.KERNEL32 ref: 00007FFDA354DF33
GetProcAddress.KERNEL32 ref: 00007FFDA354DF58
GetProcAddress.KERNEL32 ref: 00007FFDA354DF7D
GetProcAddress.KERNEL32 ref: 00007FFDA354DFA2
GetProcAddress.KERNEL32 ref: 00007FFDA354DFC7
GetProcAddress.KERNEL32 ref: 00007FFDA354DFEC
GetProcAddress.KERNEL32 ref: 00007FFDA354E011
InitializeCriticalSection.KERNEL32 ref: 00007FFDA354E03C
TlsAlloc.KERNEL32 ref: 00007FFDA354E042
DeleteCriticalSection.KERNEL32 ref: 00007FFDA354E062
TlsFree.KERNEL32 ref: 00007FFDA354E06E

Strings

AddAccessDeniedAceEx, xrefs: 00007FFDA354DF65
SetSecurityDescriptorControl, xrefs: 00007FFDA354DFF9
AddAuditAccessAceEx, xrefs: 00007FFDA354DFAF
AddAccessDeniedObjectAce, xrefs: 00007FFDA354DF8A
AdvAPI32.dll, xrefs: 00007FFDA354DE8A, 00007FFDA354DEA1
AddMandatoryAce, xrefs: 00007FFDA354DF1B
AddAuditAccessObjectAce, xrefs: 00007FFDA354DFD4
AddAccessAllowedObjectAce, xrefs: 00007FFDA354DF40
AddAccessDeniedAce, xrefs: 00007FFDA354DED1
AddAccessAllowedAceEx, xrefs: 00007FFDA354DEF6
AddAccessAllowedAce, xrefs: 00007FFDA354DEBA

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: AddressProc$CriticalSection$AllocDeleteFreeHandleInitializeLibraryLoadModule
String ID: AddAccessAllowedAce$AddAccessAllowedAceEx$AddAccessAllowedObjectAce$AddAccessDeniedAce$AddAccessDeniedAceEx$AddAccessDeniedObjectAce$AddAuditAccessAceEx$AddAuditAccessObjectAce$AddMandatoryAce$AdvAPI32.dll$SetSecurityDescriptorControl
API String ID: 3842108915-2689366622
Opcode ID: 57473d222362ce1a73b4be061c9170d604a9f0b2407b316df202a6e5a26e742f
Instruction ID: 2f57934d0f60ff1727cdeabadba289f009f504dbe429edfe667118c8351b88a6
Opcode Fuzzy Hash: 57473d222362ce1a73b4be061c9170d604a9f0b2407b316df202a6e5a26e742f
Instruction Fuzzy Hash: A9517725F0AB4695FE46DB1DFCB557437A2AF48B91B481035C80EA2362DF3EF6648348

Function 00007FFDA3543F20 Relevance: 43.9, APIs: 19, Strings: 6, Instructions: 189COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3543F4D
PySequence_Check.PYTHON313 ref: 00007FFDA3543F5F
PyErr_SetString.PYTHON313 ref: 00007FFDA3543F7A
PySequence_Size.PYTHON313 ref: 00007FFDA3543FA4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3543FB8
memset.VCRUNTIME140 ref: 00007FFDA3543FD1
PyErr_SetString.PYTHON313 ref: 00007FFDA3543FEC
PySequence_GetItem.PYTHON313 ref: 00007FFDA354402B
PyTuple_New.PYTHON313 ref: 00007FFDA3544065
PyArg_ParseTupleAndKeywords.PYTHON313 ref: 00007FFDA354409F
_Py_Dealloc.PYTHON313 ref: 00007FFDA35440B8
PyErr_SetString.PYTHON313 ref: 00007FFDA35440D4
_Py_Dealloc.PYTHON313 ref: 00007FFDA35440FB
_Py_Dealloc.PYTHON313 ref: 00007FFDA3544115
SetEntriesInAclW.ADVAPI32 ref: 00007FFDA3544149
_Py_Dealloc.PYTHON313 ref: 00007FFDA3544179
PyMem_Free.PYTHON313 ref: 00007FFDA354419E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35441B1
LocalFree.KERNEL32 ref: 00007FFDA35441E2

Strings

EXPLICIT_ACCESS must be a dictionary containing {AccessPermissions:int,AccessMode:int,Inheritance:int,Trustee:<o PyTRUSTEE>}, xrefs: 00007FFDA35440CA
SetEntriesInAcl, xrefs: 00007FFDA3544159
SetEntriesInAcl: unable to allocate EXPLICIT_ACCESS_W, xrefs: 00007FFDA3543FE2
Parm must be a list of EXPLICIT_ACCESS dictionaries, xrefs: 00007FFDA3543F70
lllO, xrefs: 00007FFDA3544086
O:SetEntriesInAcl, xrefs: 00007FFDA3543F38

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Dealloc$Err_Sequence_String$Arg_FreeParseTuple$CheckEntriesItemKeywordsLocalMem_SizeTuple_freemallocmemset
String ID: EXPLICIT_ACCESS must be a dictionary containing {AccessPermissions:int,AccessMode:int,Inheritance:int,Trustee:<o PyTRUSTEE>}$O:SetEntriesInAcl$Parm must be a list of EXPLICIT_ACCESS dictionaries$SetEntriesInAcl$SetEntriesInAcl: unable to allocate EXPLICIT_ACCESS_W$lllO
API String ID: 1438466550-1140684800
Opcode ID: acf0275f699249ee3a72eaa94773bbe7f7b2b370675f5fc8c16df187906dc64b
Instruction ID: f58fa934d6ccffc45d206c44bb687b2407518b6a6cc2a7dd9b42e6b66c023a45
Opcode Fuzzy Hash: acf0275f699249ee3a72eaa94773bbe7f7b2b370675f5fc8c16df187906dc64b
Instruction Fuzzy Hash: 3E816032B4AB8285EB168F2AE86427937A6FF85B84F144031DA4F57B16DF3EE544C704

Function 00007FFDA3545BE0 Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 164COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3545C21
_Py_NewReference.PYTHON313 ref: 00007FFDA3545D0E
PyUnicode_AsWideCharString.PYTHON313 ref: 00007FFDA3545D85
PyErr_SetString.PYTHON313 ref: 00007FFDA3545DA4
CLSIDFromString.OLE32 ref: 00007FFDA3545DB6
CLSIDFromProgID.OLE32 ref: 00007FFDA3545DC7
PyMem_Free.PYTHON313 ref: 00007FFDA3545DD6
PyErr_SetString.PYTHON313 ref: 00007FFDA3545C5A

Part of subcall function 00007FFDA354E768: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354E782

PyObject_GetBuffer.PYTHON313 ref: 00007FFDA3545C6E
PyBuffer_Release.PYTHON313 ref: 00007FFDA3545C89
PyErr_Format.PYTHON313 ref: 00007FFDA3545CA3
PyErr_Format.PYTHON313 ref: 00007FFDA3545CD9
PyBuffer_Release.PYTHON313 ref: 00007FFDA3545D32
PyErr_SetString.PYTHON313 ref: 00007FFDA3545E33

Strings

None is not a valid string in this context, xrefs: 00007FFDA3545E22
O|i, xrefs: 00007FFDA3545C1A
Buffer length can be at most %d characters, xrefs: 00007FFDA3545C92
Getting WCHAR string, xrefs: 00007FFDA3545D93
string too small - must be at least %d bytes (got %d), xrefs: 00007FFDA3545CC8
Objects of type '%s' can not be converted to Unicode., xrefs: 00007FFDA3545E4D
<NULL!!>, xrefs: 00007FFDA3545E46
Buffer cannot be None, xrefs: 00007FFDA3545C49

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_String$Buffer_FormatFromRelease$Arg_BufferCharFreeMem_Object_ParseProgReferenceTupleUnicode_Widemalloc
String ID: <NULL!!>$Buffer cannot be None$Buffer length can be at most %d characters$Getting WCHAR string$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.$O|i$string too small - must be at least %d bytes (got %d)
API String ID: 4105764891-2902820477
Opcode ID: 617d2196de1cec3ed8d6d8ab3add72d5df5a5d96e77225db4f40206af1f54af4
Instruction ID: b9709e8ef1b8608958234c7195db2ca8a341815feaf08042d3a3720833c4d0f7
Opcode Fuzzy Hash: 617d2196de1cec3ed8d6d8ab3add72d5df5a5d96e77225db4f40206af1f54af4
Instruction Fuzzy Hash: F081F721F0AB42C5EB16CF69D4642B827A3AB84B84F444435DA0F67B56DF3EF648C348

Function 00007FFDA3547610 Relevance: 42.1, APIs: 17, Strings: 7, Instructions: 136COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA354763D
_Py_NewReference.PYTHON313 ref: 00007FFDA3547671
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3547681
InitializeSecurityDescriptor.ADVAPI32 ref: 00007FFDA3547696
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35476AE
PyErr_Occurred.PYTHON313 ref: 00007FFDA35476BA
PyErr_SetString.PYTHON313 ref: 00007FFDA35476D6
_Py_Dealloc.PYTHON313 ref: 00007FFDA35476E9

Part of subcall function 00007FFDA3547D20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D3B
Part of subcall function 00007FFDA3547D20: GetSecurityDescriptorLength.ADVAPI32(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D44

PyErr_Clear.PYTHON313 ref: 00007FFDA35476FA
PyErr_SetString.PYTHON313 ref: 00007FFDA3547754

Part of subcall function 00007FFDA35475D0: GetSecurityDescriptorControl.ADVAPI32 ref: 00007FFDA35475DE

PyObject_GetBuffer.PYTHON313 ref: 00007FFDA3547769
PyBuffer_Release.PYTHON313 ref: 00007FFDA3547787
PyErr_Format.PYTHON313 ref: 00007FFDA35477A1
IsValidSecurityDescriptor.ADVAPI32 ref: 00007FFDA35477BE
PyErr_SetString.PYTHON313 ref: 00007FFDA35477D9
PyArg_ParseTuple.PYTHON313 ref: 00007FFDA354771C

Part of subcall function 00007FFDA354E768: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354E782

PyBuffer_Release.PYTHON313 ref: 00007FFDA354782B

Strings

Data is not a valid security descriptor, xrefs: 00007FFDA35477C8
O:SECURITY_DESCRIPTOR, xrefs: 00007FFDA3547712
Security descriptor created from a buffer must be self relative, xrefs: 00007FFDA35477ED
Security descriptors are not supported on this platform, xrefs: 00007FFDA35476C5
Buffer length can be at most %d characters, xrefs: 00007FFDA3547790
|l:SECURITY_DESCRIPTOR, xrefs: 00007FFDA3547633
Buffer cannot be None, xrefs: 00007FFDA3547743

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$DescriptorSecurity$String$Arg_Buffer_ParseReleaseTuplefreemalloc$BufferClearControlDeallocFormatInitializeLengthObject_OccurredReferenceValid
String ID: Buffer cannot be None$Buffer length can be at most %d characters$Data is not a valid security descriptor$O:SECURITY_DESCRIPTOR$Security descriptor created from a buffer must be self relative$Security descriptors are not supported on this platform$|l:SECURITY_DESCRIPTOR
API String ID: 929864077-2729865943
Opcode ID: 907e45069e2a562dd984d1ee0477dffeda1de1be7776d16703d8a25f67731b20
Instruction ID: 59b8cd848d13377fc10ca543b0371d8cb5123aaa419c11049f10e18a73e4521c
Opcode Fuzzy Hash: 907e45069e2a562dd984d1ee0477dffeda1de1be7776d16703d8a25f67731b20
Instruction Fuzzy Hash: DB611621F0AB4281EE5A8F19E9A027823A3FB84B80F444035D95F67B66DF3EF545C748

Function 00007FFDA3547A80 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 181COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3547AC5
PyErr_Format.PYTHON313 ref: 00007FFDA3547AE8
memset.VCRUNTIME140 ref: 00007FFDA3547AFF
MakeAbsoluteSD.ADVAPI32 ref: 00007FFDA3547B47

Strings

Unable to allocate %d bytes, xrefs: 00007FFDA3547ADA, 00007FFDA3547BBA, 00007FFDA3547C01
MakeAbsoluteSD, xrefs: 00007FFDA3547CAC
(, xrefs: 00007FFDA3547B5E

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: AbsoluteErr_FormatMakemallocmemset
String ID: ($MakeAbsoluteSD$Unable to allocate %d bytes
API String ID: 1436552674-2130869594
Opcode ID: 817e4bd11004b34f0d9ee0657aa47416c8f7398feaa8474a98fd3fe14e7fbdd3
Instruction ID: b6c00a8e9187b86ca17d96db1692b0e3adef902fd7021ae2540d95db4114b81b
Opcode Fuzzy Hash: 817e4bd11004b34f0d9ee0657aa47416c8f7398feaa8474a98fd3fe14e7fbdd3
Instruction Fuzzy Hash: 6E818431F06B4286EB568F6AE8606B937A2FB48B98F044035DD1E63B55EF3EE544C704

Function 00007FFDA3542410 Relevance: 38.6, APIs: 9, Strings: 13, Instructions: 113COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA3542448
PyErr_SetString.PYTHON313 ref: 00007FFDA3542466
PyUnicode_FromWideChar.PYTHON313 ref: 00007FFDA35424AA
Py_BuildValue.PYTHON313 ref: 00007FFDA35425A2
Py_BuildValue.PYTHON313 ref: 00007FFDA35425EB

Strings

TrusteeForm, xrefs: 00007FFDA354258F
TrusteeType, xrefs: 00007FFDA354257C
{s:l,s:l,s:l,s:N}, xrefs: 00007FFDA35425CA
Identifier, xrefs: 00007FFDA354254F
Inheritance, xrefs: 00007FFDA35425D8
{s:O,s:l,s:l,s:l,s:N}, xrefs: 00007FFDA3542571
TrusteeForm not yet supported, xrefs: 00007FFDA354245C
AccessPermissions, xrefs: 00007FFDA35425B7
MultipleTrusteeOperation, xrefs: 00007FFDA354255B
MultipleTrustee, xrefs: 00007FFDA3542567
Invalid value for TrusteeForm, xrefs: 00007FFDA354243E
Trustee, xrefs: 00007FFDA35425BE
AccessMode, xrefs: 00007FFDA35425AB

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: BuildErr_StringValue$CharFromUnicode_Wide
String ID: AccessMode$AccessPermissions$Identifier$Inheritance$Invalid value for TrusteeForm$MultipleTrustee$MultipleTrusteeOperation$Trustee$TrusteeForm$TrusteeForm not yet supported$TrusteeType${s:O,s:l,s:l,s:l,s:N}${s:l,s:l,s:l,s:N}
API String ID: 4150572817-4268317626
Opcode ID: c98c665ab8a0a4017fd0a264350303892bf8c1112e9847fedee4e5de0a27f4e9
Instruction ID: 3204d9ac89adedeac67f2202101d6971fe6499980e4852a96bc1600cceaf2180
Opcode Fuzzy Hash: c98c665ab8a0a4017fd0a264350303892bf8c1112e9847fedee4e5de0a27f4e9
Instruction Fuzzy Hash: 45516A35B0AB4286EB268F1DF46006937A2FB48B90F144135DA4E63B66DF3EF545C708

Function 00007FFDA3543890 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 174COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON313 ref: 00007FFDA35438DC
PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3543947
PyErr_SetString.PYTHON313 ref: 00007FFDA35439B5
AddAuditAccessObjectAce.ADVAPI32 ref: 00007FFDA3543A20
GetLastError.KERNEL32 ref: 00007FFDA3543A2E
GetLengthSid.ADVAPI32 ref: 00007FFDA3543A51
PyErr_Format.PYTHON313 ref: 00007FFDA3543A81
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3543A8E
PyErr_Format.PYTHON313 ref: 00007FFDA3543AB0
memset.VCRUNTIME140 ref: 00007FFDA3543AC3
memcpy.VCRUNTIME140 ref: 00007FFDA3543AD3
AddAuditAccessObjectAce.ADVAPI32 ref: 00007FFDA3543B07
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3543B21
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3543B60

Strings

AddAuditAccessObjectAce not supported by this version of Windows, xrefs: 00007FFDA35438D2
The object is not a PySID object, xrefs: 00007FFDA35439AB
%s: adding ACE would put ACL over size limit, xrefs: 00007FFDA3543A77
lllOOOii:AddAuditAccessObjectAce, xrefs: 00007FFDA3543922
AddAuditAccessObjectAce: unable to allocated %d bytes, xrefs: 00007FFDA3543AA3
AddAuditAccessObjectAce, xrefs: 00007FFDA3543A3D, 00007FFDA3543B51
PyACL::AddAuditAccessObjectAce, xrefs: 00007FFDA3543A70

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$Format$AccessAuditObjectfree$Arg_ErrorLastLengthParseStringTuplemallocmemcpymemset
String ID: %s: adding ACE would put ACL over size limit$AddAuditAccessObjectAce$AddAuditAccessObjectAce not supported by this version of Windows$AddAuditAccessObjectAce: unable to allocated %d bytes$PyACL::AddAuditAccessObjectAce$The object is not a PySID object$lllOOOii:AddAuditAccessObjectAce
API String ID: 282185603-1609464327
Opcode ID: 26eaf46bba8aa332da59d73b146c913fc64544bd534984a4cf7e3efad4388a83
Instruction ID: 34e2ab5e29d27cb3526056d212551de11404fdafa8eda240b49dcc0111525d62
Opcode Fuzzy Hash: 26eaf46bba8aa332da59d73b146c913fc64544bd534984a4cf7e3efad4388a83
Instruction Fuzzy Hash: A8814D21B1AA0286EB16CF59E8601B973B2FB44B84F440035ED4E63BA5DF3DE519C748

Function 00007FFDA3543620 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 139COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON313 ref: 00007FFDA354364C
PyArg_ParseTuple.PYTHON313 ref: 00007FFDA35436B5
PyErr_SetString.PYTHON313 ref: 00007FFDA35436E2

Strings

lllOii:AddAuditAccessAceEx, xrefs: 00007FFDA3543699
The object is not a PySID object, xrefs: 00007FFDA35436D8
PyACL::AddAuditAccessAceEx, xrefs: 00007FFDA3543787
%s: adding ACE would put ACL over size limit, xrefs: 00007FFDA354378E
AddAuditAccessAceEx not supported by this version of Windows, xrefs: 00007FFDA3543642
AddAuditAccessAceEx, xrefs: 00007FFDA3543758, 00007FFDA354386F
AddAuditAccessAceEx: unable to allocated %d bytes, xrefs: 00007FFDA35437BD

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$Arg_FormatParseStringTuple
String ID: %s: adding ACE would put ACL over size limit$AddAuditAccessAceEx$AddAuditAccessAceEx not supported by this version of Windows$AddAuditAccessAceEx: unable to allocated %d bytes$PyACL::AddAuditAccessAceEx$The object is not a PySID object$lllOii:AddAuditAccessAceEx
API String ID: 901859003-3541680958
Opcode ID: dd1c56f6490d01056c0aa620be259863251a6bb8c3dca21ebab00ade8506534f
Instruction ID: 538b25e3f9f1a2a578949517a0779de34f44a8c1074f01bb04bf05571d1a6d86
Opcode Fuzzy Hash: dd1c56f6490d01056c0aa620be259863251a6bb8c3dca21ebab00ade8506534f
Instruction Fuzzy Hash: 84617431B1A74282DB55CF59E46027977A2FB84B84F044031EA4E63B66DF3EE519CB04

Function 00007FFDA3675194 Relevance: 36.2, APIs: 24, Instructions: 170COMMON

Download Yara Rule

APIs

X509_NAME_entry_count.LIBCRYPTO-3 ref: 00007FFDA36751B8
PyList_New.PYTHON313 ref: 00007FFDA36751C7
PyList_New.PYTHON313 ref: 00007FFDA36751DB
X509_NAME_get_entry.LIBCRYPTO-3 ref: 00007FFDA36751FD
X509_NAME_ENTRY_set.LIBCRYPTO-3 ref: 00007FFDA367520E
PyList_AsTuple.PYTHON313 ref: 00007FFDA367521C
_Py_Dealloc.PYTHON313 ref: 00007FFDA3675233
PyList_Append.PYTHON313 ref: 00007FFDA3675248
_Py_Dealloc.PYTHON313 ref: 00007FFDA367525E
PyList_New.PYTHON313 ref: 00007FFDA367526E
X509_NAME_ENTRY_set.LIBCRYPTO-3 ref: 00007FFDA3675283
X509_NAME_ENTRY_get_object.LIBCRYPTO-3 ref: 00007FFDA367528F
X509_NAME_ENTRY_get_data.LIBCRYPTO-3 ref: 00007FFDA367529B
PyList_Append.PYTHON313 ref: 00007FFDA36752C3
_Py_Dealloc.PYTHON313 ref: 00007FFDA36752DA
PyList_AsTuple.PYTHON313 ref: 00007FFDA3675310
_Py_Dealloc.PYTHON313 ref: 00007FFDA3675327
PyList_Append.PYTHON313 ref: 00007FFDA3675338
_Py_Dealloc.PYTHON313 ref: 00007FFDA367534E
_Py_Dealloc.PYTHON313 ref: 00007FFDA3675366
_Py_Dealloc.PYTHON313 ref: 00007FFDA3675396
_Py_Dealloc.PYTHON313 ref: 00007FFDA36753AC
PyList_AsTuple.PYTHON313 ref: 00007FFDA36753B5
_Py_Dealloc.PYTHON313 ref: 00007FFDA36753CC

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: DeallocList_$X509_$AppendTuple$Y_set$E_entry_countE_get_entryY_get_dataY_get_object
String ID:
API String ID: 3918441104-0
Opcode ID: db818d51d449e72e9899e89badedafafe268f1228f328daead792f54bb8280e6
Instruction ID: 6799bc53b73a9aad666591c97ea630362f9b215e46ff3a4c9658c46842bf2ff8
Opcode Fuzzy Hash: db818d51d449e72e9899e89badedafafe268f1228f328daead792f54bb8280e6
Instruction Fuzzy Hash: E3616F31F0BB4281FA585B21992433962D3BF45BA5F9C2474CB1E667A2FF7FA0458308

Function 00007FFDA3674F10 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 146COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA3674F53
BIO_new_mem_buf.LIBCRYPTO-3 ref: 00007FFDA3674F80
SSL_CTX_get_cert_store.LIBSSL-3 ref: 00007FFDA3674FAF
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFDA3674FCD
d2i_X509_bio.LIBCRYPTO-3 ref: 00007FFDA3674FE0
SSL_CTX_get_default_passwd_cb_userdata.LIBSSL-3 ref: 00007FFDA3674FEC
SSL_CTX_get_default_passwd_cb.LIBSSL-3 ref: 00007FFDA3674FF9
PEM_read_bio_X509.LIBCRYPTO-3 ref: 00007FFDA367500A
X509_STORE_add_cert.LIBCRYPTO-3 ref: 00007FFDA3675023
X509_free.LIBCRYPTO-3 ref: 00007FFDA367502E
ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFDA3675038
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA3675066
ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFDA367507F
BIO_free.LIBCRYPTO-3 ref: 00007FFDA36750D5
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA367511B

Part of subcall function 00007FFDA3676750: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFDA3676768
Part of subcall function 00007FFDA3676750: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA3676791

Strings

Empty certificate data, xrefs: 00007FFDA3674F49
Certificate data is too long., xrefs: 00007FFDA3674F71
Can't allocate buffer, xrefs: 00007FFDA3674F92
no start line: cadata does not contain a certificate, xrefs: 00007FFDA367509E
not enough data: cadata does not contain a certificate, xrefs: 00007FFDA3675097

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: R_clear_errorR_peek_last_error$E_add_certErr_M_read_bio_O_ctrlO_freeO_new_mem_bufStringX509X509_X509_bioX509_freeX_get_cert_storeX_get_default_passwd_cbX_get_default_passwd_cb_userdatad2i_
String ID: Can't allocate buffer$Certificate data is too long.$Empty certificate data$no start line: cadata does not contain a certificate$not enough data: cadata does not contain a certificate
API String ID: 2827233063-3246380861
Opcode ID: f77df0b0a087a1a67b16f0981dcb06e07524f71215003e28bcc92bd1838cc09b
Instruction ID: 80d2d4173c3c3e7a9b8e9d121a069ae51cf0c69422cd275f3f4b60c390d9a35c
Opcode Fuzzy Hash: f77df0b0a087a1a67b16f0981dcb06e07524f71215003e28bcc92bd1838cc09b
Instruction Fuzzy Hash: EA51DD21F0A60382FB549725AC742396393BF84B88F9C6531DE1E67797DF3EE4498608

Function 00007FFDA354B720 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 148COMMON

Download Yara Rule

APIs

PySequence_Tuple.PYTHON313(?,?,?,?,?,00007FFDA354B55E), ref: 00007FFDA354B75D
_Py_Dealloc.PYTHON313(?,?,?,?,?,00007FFDA354B55E), ref: 00007FFDA354B786
PyErr_Format.PYTHON313(?,?,?,?,?,00007FFDA354B55E), ref: 00007FFDA354B7A0
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFDA354B55E), ref: 00007FFDA354B7D6
PyErr_Format.PYTHON313(?,?,?,?,?,00007FFDA354B55E), ref: 00007FFDA354B7F9
memset.VCRUNTIME140(?,?,?,?,?,00007FFDA354B55E), ref: 00007FFDA354B811
PyUnicode_AsWideCharString.PYTHON313 ref: 00007FFDA354B85E
PyErr_SetString.PYTHON313 ref: 00007FFDA354B881
PyMem_Free.PYTHON313 ref: 00007FFDA354B8A3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354B8B6
_Py_Dealloc.PYTHON313(?,?,?,?,?,00007FFDA354B55E), ref: 00007FFDA354B944

Strings

Sequence can contain at most %d items, xrefs: 00007FFDA354B793
Unable to allocate %d bytes, xrefs: 00007FFDA354B7EC
None is not a valid string in this context, xrefs: 00007FFDA354B8D5
Getting WCHAR string, xrefs: 00007FFDA354B877
Objects of type '%s' can not be converted to Unicode., xrefs: 00007FFDA354B900
<NULL!!>, xrefs: 00007FFDA354B8F2

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$DeallocFormatString$CharFreeMem_Sequence_TupleUnicode_Widefreemallocmemset
String ID: <NULL!!>$Getting WCHAR string$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.$Sequence can contain at most %d items$Unable to allocate %d bytes
API String ID: 1433913835-2102981847
Opcode ID: 8535e905c18311b126149db4c654d6e50bde341e448ca8767d7c62fbaddd82d7
Instruction ID: 7995711684f338ae250b064d310af6d4ff0d1814d96e939bf564bc4db55e0ee9
Opcode Fuzzy Hash: 8535e905c18311b126149db4c654d6e50bde341e448ca8767d7c62fbaddd82d7
Instruction Fuzzy Hash: 51613B32F0AB4682EE16CF19E46417877A2BB84B84F494035DA8E63762DF3EF545C748

Function 00007FFDA3543410 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 126COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3543456
PyErr_SetString.PYTHON313 ref: 00007FFDA3543483
AddAuditAccessAce.ADVAPI32 ref: 00007FFDA35434CB
GetLastError.KERNEL32 ref: 00007FFDA35434D9
GetLengthSid.ADVAPI32 ref: 00007FFDA35434F9
PyErr_Format.PYTHON313 ref: 00007FFDA3543528
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3543538
PyErr_Format.PYTHON313 ref: 00007FFDA354355A
memset.VCRUNTIME140 ref: 00007FFDA354356D
memcpy.VCRUNTIME140 ref: 00007FFDA354357D
AddAuditAccessAce.ADVAPI32 ref: 00007FFDA35435AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35435C8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3543607

Strings

llOii:AddAuditAccessAce, xrefs: 00007FFDA354343C
AddAuditAccessAce: unable to allocated %d bytes, xrefs: 00007FFDA354354D
AddAuditAccessAce, xrefs: 00007FFDA35434E8, 00007FFDA35435F8
The object is not a PySID object, xrefs: 00007FFDA3543479
PyACL::AddAuditAccessAce, xrefs: 00007FFDA3543517
%s: adding ACE would put ACL over size limit, xrefs: 00007FFDA354351E

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$AccessAuditFormatfree$Arg_ErrorLastLengthParseStringTuplemallocmemcpymemset
String ID: %s: adding ACE would put ACL over size limit$AddAuditAccessAce$AddAuditAccessAce: unable to allocated %d bytes$PyACL::AddAuditAccessAce$The object is not a PySID object$llOii:AddAuditAccessAce
API String ID: 3041754842-240227349
Opcode ID: 41c427efde199c7782ebfe022160a6b9792f91ee7cbc64d9b07f2f7f8afba0ed
Instruction ID: 3f0c9f3900cb1065bd779690df1155cd9f44834ad520671c6e23cd0b8731ce25
Opcode Fuzzy Hash: 41c427efde199c7782ebfe022160a6b9792f91ee7cbc64d9b07f2f7f8afba0ed
Instruction Fuzzy Hash: 63518121B1A74286EB1ACF5AE8645B937A3FF84B84F044035D91E53B62DF3EF5098708

Function 00007FFDA3679EA0 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 174threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA3673C98: PyWeakref_GetRef.PYTHON313 ref: 00007FFDA3673CAA
Part of subcall function 00007FFDA3673C98: _Py_Dealloc.PYTHON313 ref: 00007FFDA3673CCC

SSL_get_rbio.LIBSSL-3 ref: 00007FFDA3679F03
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFDA3679F18
SSL_get_wbio.LIBSSL-3 ref: 00007FFDA3679F22
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFDA3679F33
_PyDeadline_Init.PYTHON313 ref: 00007FFDA3679F4B
PyEval_SaveThread.PYTHON313 ref: 00007FFDA3679F98
SSL_set_read_ahead.LIBSSL-3 ref: 00007FFDA3679FB1
SSL_shutdown.LIBSSL-3 ref: 00007FFDA3679FBE
PyEval_RestoreThread.PYTHON313 ref: 00007FFDA3679FF8
_PyDeadline_Get.PYTHON313 ref: 00007FFDA367A03E
_Py_Dealloc.PYTHON313 ref: 00007FFDA367A08E
PyErr_SetString.PYTHON313 ref: 00007FFDA367A0D9
_Py_Dealloc.PYTHON313 ref: 00007FFDA367A0FB

Strings

Underlying socket too large for select()., xrefs: 00007FFDA367A0AB
Underlying socket connection gone, xrefs: 00007FFDA3679F5F
B, xrefs: 00007FFDA3679F6C
The write operation timed out, xrefs: 00007FFDA367A0D2
The read operation timed out, xrefs: 00007FFDA367A0C3

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Dealloc$Deadline_Eval_O_ctrlThread$Err_InitL_get_rbioL_get_wbioL_set_read_aheadL_shutdownRestoreSaveStringWeakref_
String ID: B$The read operation timed out$The write operation timed out$Underlying socket connection gone$Underlying socket too large for select().
API String ID: 3315248981-1139084988
Opcode ID: 5943a039c6cdb38d5f61f64391e52815a8c3dd02f3e8eae8b1d42f492bb51cbe
Instruction ID: 57cd84a4edf9d14a877e029c5e2ccbc5abfcc03160b5e37c814ebdd0d54365ee
Opcode Fuzzy Hash: 5943a039c6cdb38d5f61f64391e52815a8c3dd02f3e8eae8b1d42f492bb51cbe
Instruction Fuzzy Hash: D671A231B0AA4286FB608F11D56427973A2FF85B94F986531DE4E27792DF3EE485C308

Function 00007FFDA35484D0 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3548507
PyErr_SetString.PYTHON313 ref: 00007FFDA3548541
IsValidSid.ADVAPI32 ref: 00007FFDA3548561

Part of subcall function 00007FFDA3547A80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3547AC5
Part of subcall function 00007FFDA3547A80: PyErr_Format.PYTHON313 ref: 00007FFDA3547AE8

GetSecurityDescriptorGroup.ADVAPI32 ref: 00007FFDA35485AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35485BD
SetSecurityDescriptorGroup.ADVAPI32 ref: 00007FFDA35485CD
GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FFDA3548628
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3548641
GetSecurityDescriptorSacl.ADVAPI32 ref: 00007FFDA3548656
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354866F
GetSecurityDescriptorOwner.ADVAPI32 ref: 00007FFDA3548680
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3548693
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354869C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35486AF

Strings

Oi:SetSecurityDescriptorOwner, xrefs: 00007FFDA3548500
The object is not a PySID object, xrefs: 00007FFDA3548537
SetSecurityDescriptorGroup, xrefs: 00007FFDA35485D9
SetSecurityDescriptorGroup - invalid sid, xrefs: 00007FFDA354856D

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: free$DescriptorSecurity$Err_Group$Arg_DaclFormatOwnerParseSaclStringTupleValidmalloc
String ID: Oi:SetSecurityDescriptorOwner$SetSecurityDescriptorGroup$SetSecurityDescriptorGroup - invalid sid$The object is not a PySID object
API String ID: 1524979833-2851344522
Opcode ID: c300119cf340fa15e331d90d47fc04b330e8a1bbcced3dc3e73c2575c99f7ea4
Instruction ID: e69670e8dbf79f43f3d8829ee2934462f579c0db9c9848f269f82e9dd931ec23
Opcode Fuzzy Hash: c300119cf340fa15e331d90d47fc04b330e8a1bbcced3dc3e73c2575c99f7ea4
Instruction Fuzzy Hash: 00516F22B0AA0695EF5A9F6EE8201F827A3BF40B88B440432DD1E67756DF3FE545C344

Function 00007FFDA3544770 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA3544792
PyUnicode_AsWideCharString.PYTHON313 ref: 00007FFDA35447D7
PyErr_SetString.PYTHON313 ref: 00007FFDA35447F6

Strings

value is larger than a DWORD, xrefs: 00007FFDA3544817
None is not a valid string in this context, xrefs: 00007FFDA35448C7
FormName must be a string of length %d or less, xrefs: 00007FFDA3544842
Attributes of PyDEVMODEW can't be deleted, xrefs: 00007FFDA3544788
Getting WCHAR string, xrefs: 00007FFDA35447EC
Objects of type '%s' can not be converted to Unicode., xrefs: 00007FFDA35448F2
<NULL!!>, xrefs: 00007FFDA35448E4

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: String$Err_$CharUnicode_Wide
String ID: <NULL!!>$Attributes of PyDEVMODEW can't be deleted$FormName must be a string of length %d or less$Getting WCHAR string$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.$value is larger than a DWORD
API String ID: 3849944921-358745228
Opcode ID: bdc3e7128bf631bb1fbc859662b68c46382314d96899fc7225cfab469126a8c4
Instruction ID: 8919fd77a950c31409c7cab6c7b6ab5131da69bac3a479e6f4b58855660a4658
Opcode Fuzzy Hash: bdc3e7128bf631bb1fbc859662b68c46382314d96899fc7225cfab469126a8c4
Instruction Fuzzy Hash: 7A417F61F0AB4282EE16CF1DE4A11782362FB84B84F145131DA0F67BA2DF2EF5858308

Function 00007FFDA3544560 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA3544582
PyUnicode_AsWideCharString.PYTHON313 ref: 00007FFDA35445C7
PyErr_SetString.PYTHON313 ref: 00007FFDA35445E6

Strings

DeviceName must be a string of length %d or less, xrefs: 00007FFDA3544632
value is larger than a DWORD, xrefs: 00007FFDA3544607
None is not a valid string in this context, xrefs: 00007FFDA35446B8
Attributes of PyDEVMODEW can't be deleted, xrefs: 00007FFDA3544578
Getting WCHAR string, xrefs: 00007FFDA35445DC
Objects of type '%s' can not be converted to Unicode., xrefs: 00007FFDA35446E3
<NULL!!>, xrefs: 00007FFDA35446D5

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: String$Err_$CharUnicode_Wide
String ID: <NULL!!>$Attributes of PyDEVMODEW can't be deleted$DeviceName must be a string of length %d or less$Getting WCHAR string$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.$value is larger than a DWORD
API String ID: 3849944921-3701856451
Opcode ID: 1339cf3604d15a9370892e0da6ac1f78a1d8c00d4b1d96f8de384227f0a6a403
Instruction ID: e1bab1474260a38f3796156d70a26a95af327c995f193f89b440d6e77f37ff79
Opcode Fuzzy Hash: 1339cf3604d15a9370892e0da6ac1f78a1d8c00d4b1d96f8de384227f0a6a403
Instruction Fuzzy Hash: B2417061F0AB4282EE16CB1EE4A01792363FB88BD4F145131DA5F67B66DF2EF5848344

Function 00007FFDA354C620 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 155windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 00007FFDA354C667
wsprintfW.USER32 ref: 00007FFDA354C6B9
PyUnicode_FromWideChar.PYTHON313 ref: 00007FFDA354C6DE
Py_BuildValue.PYTHON313 ref: 00007FFDA354C6F8
PyErr_SetObject.PYTHON313 ref: 00007FFDA354C70B
_Py_Dealloc.PYTHON313 ref: 00007FFDA354C723
PyArg_ParseTuple.PYTHON313 ref: 00007FFDA354C776
PyErr_SetString.PYTHON313 ref: 00007FFDA354C7B8
PyObject_GetBuffer.PYTHON313 ref: 00007FFDA354C7D1
PyBuffer_Release.PYTHON313 ref: 00007FFDA354C7F4
PyErr_Format.PYTHON313 ref: 00007FFDA354C80E
PyUnicode_FromWideChar.PYTHON313 ref: 00007FFDA354C84A
PyBuffer_Release.PYTHON313 ref: 00007FFDA354C86B

Strings

iNzz, xrefs: 00007FFDA354C6EF
COM Error 0x%x, xrefs: 00007FFDA354C6AD
Buffer length can be at most %d characters, xrefs: 00007FFDA354C801
Buffer cannot be None, xrefs: 00007FFDA354C7AE

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$Buffer_CharFormatFromReleaseUnicode_Wide$Arg_BufferBuildDeallocMessageObjectObject_ParseStringTupleValuewsprintf
String ID: Buffer cannot be None$Buffer length can be at most %d characters$COM Error 0x%x$iNzz
API String ID: 2036073046-2401320735
Opcode ID: 4fed1c0e6664d21868abd63e6797ee29565fbc786b664ad84a8487749ffcb9f1
Instruction ID: 6b9ad32d8edbd7517ef7951b34d6698b7b82fa42996503cd0401021cb1f67eb5
Opcode Fuzzy Hash: 4fed1c0e6664d21868abd63e6797ee29565fbc786b664ad84a8487749ffcb9f1
Instruction Fuzzy Hash: 5F61A331F0AA4282EF668F1DE86027963A3FF85794F444135DA4E53BA6DF3EE5048748

Function 00007FFDA367C3D0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDA367C3F4
SSL_get_ex_data.LIBSSL-3 ref: 00007FFDA367C403
PyUnicode_DecodeUTF8.PYTHON313 ref: 00007FFDA367C44D
PyErr_Clear.PYTHON313 ref: 00007FFDA367C46D
PyObject_CallFunctionObjArgs.PYTHON313 ref: 00007FFDA367C481
_Py_Dealloc.PYTHON313 ref: 00007FFDA367C498
PyArg_ParseTuple.PYTHON313 ref: 00007FFDA367C4D5
memcpy.VCRUNTIME140 ref: 00007FFDA367C50B
memcpy.VCRUNTIME140 ref: 00007FFDA367C520
_Py_Dealloc.PYTHON313 ref: 00007FFDA367C538
PyGILState_Release.PYTHON313 ref: 00007FFDA367C540
_Py_Dealloc.PYTHON313 ref: 00007FFDA367C55A
PyErr_Occurred.PYTHON313 ref: 00007FFDA367C560
PyErr_WriteUnraisable.PYTHON313 ref: 00007FFDA367C56E
PyGILState_Release.PYTHON313 ref: 00007FFDA367C576

Strings

z#y#, xrefs: 00007FFDA367C4CE
strict, xrefs: 00007FFDA367C443

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: DeallocErr_State_$Releasememcpy$Arg_ArgsCallClearDecodeEnsureFunctionL_get_ex_dataObject_OccurredParseTupleUnicode_UnraisableWrite
String ID: strict$z#y#
API String ID: 311804506-2662034392
Opcode ID: 1db957280277213e8634e1e9bf35a161e2a8030f33213582c3943b94ad45a2c4
Instruction ID: f1771c5589bffa18b6a2de084d81f393d3719901bd90c3cfb8b6510195ed7059
Opcode Fuzzy Hash: 1db957280277213e8634e1e9bf35a161e2a8030f33213582c3943b94ad45a2c4
Instruction Fuzzy Hash: 2C514D32B0AA8282FB558F11E52427967A2FB45FD0F8C6131DA4E27796DF3EE4548708

Function 00007FFDA3548070 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 141COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA35480AC
PyErr_SetString.PYTHON313 ref: 00007FFDA35480E6
GetSecurityDescriptorSacl.ADVAPI32 ref: 00007FFDA354812A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3548142
SetSecurityDescriptorSacl.ADVAPI32 ref: 00007FFDA3548155
GetSecurityDescriptorOwner.ADVAPI32 ref: 00007FFDA35481A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35481BB
GetSecurityDescriptorGroup.ADVAPI32 ref: 00007FFDA35481CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35481DF
GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FFDA35481F4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354820D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3548216
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354822C

Part of subcall function 00007FFDA3547950: IsValidSecurityDescriptor.ADVAPI32(?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA3547960
Part of subcall function 00007FFDA3547950: PyErr_SetString.PYTHON313(?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354797B

Part of subcall function 00007FFDA3547D20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D3B
Part of subcall function 00007FFDA3547D20: GetSecurityDescriptorLength.ADVAPI32(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D44

Strings

The object is not a PyACL object, xrefs: 00007FFDA35480DC
SetSecurityDescriptorSacl, xrefs: 00007FFDA3548161
iOi:SetSacl, xrefs: 00007FFDA35480A3

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: DescriptorSecurityfree$Err_SaclString$Arg_DaclGroupLengthOwnerParseTupleValid
String ID: SetSecurityDescriptorSacl$The object is not a PyACL object$iOi:SetSacl
API String ID: 1467358711-1973599164
Opcode ID: ca031ff84b3ac6ab0230af49dea1aa47d77822ddcdcf60e7dd2b298a8373459c
Instruction ID: d2ec79c9f841d669df0939fd37fad988d0d705dc2cc0d40c23075a2da17561d0
Opcode Fuzzy Hash: ca031ff84b3ac6ab0230af49dea1aa47d77822ddcdcf60e7dd2b298a8373459c
Instruction Fuzzy Hash: 33515F22F0AB4285FF5A9F69D8605B827A3BF44B84B444032DE1E67B56DF3EE545C308

Function 00007FFDA35482F0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA354831C
PyErr_SetString.PYTHON313 ref: 00007FFDA3548356
GetSecurityDescriptorOwner.ADVAPI32 ref: 00007FFDA35483A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35483B5
SetSecurityDescriptorOwner.ADVAPI32 ref: 00007FFDA35483C5
GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FFDA3548420
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3548439
GetSecurityDescriptorSacl.ADVAPI32 ref: 00007FFDA354844E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3548467
GetSecurityDescriptorGroup.ADVAPI32 ref: 00007FFDA3548478
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354848B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3548494
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35484A7

Part of subcall function 00007FFDA3547950: IsValidSecurityDescriptor.ADVAPI32(?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA3547960
Part of subcall function 00007FFDA3547950: PyErr_SetString.PYTHON313(?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354797B

Part of subcall function 00007FFDA3547D20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D3B
Part of subcall function 00007FFDA3547D20: GetSecurityDescriptorLength.ADVAPI32(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D44

Strings

Oi:SetSecurityDescriptorOwner, xrefs: 00007FFDA354830E
The object is not a PySID object, xrefs: 00007FFDA354834C
SetSecurityDescriptorOwner, xrefs: 00007FFDA35483D1

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: DescriptorSecurityfree$Err_OwnerString$Arg_DaclGroupLengthParseSaclTupleValid
String ID: Oi:SetSecurityDescriptorOwner$SetSecurityDescriptorOwner$The object is not a PySID object
API String ID: 965136164-2833774516
Opcode ID: 7271bdf78a4c65457abcfe2ff72261ddf3eb67bcd4a8f1aaaa12165b7929d36e
Instruction ID: cd5693535c2525324dd077e6104488719e4feebefdaa15424f51d837f020a81e
Opcode Fuzzy Hash: 7271bdf78a4c65457abcfe2ff72261ddf3eb67bcd4a8f1aaaa12165b7929d36e
Instruction Fuzzy Hash: 76515122B0A70285EF5A9F69E8602B827A3BF44BC8B444432DD1F67B55DF3EE545C344

Function 00007FFDA3541F50 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 124COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON313 ref: 00007FFDA3541FB8
PyArg_ParseTupleAndKeywords.PYTHON313 ref: 00007FFDA3542006
_Py_Dealloc.PYTHON313 ref: 00007FFDA354201E
PyErr_SetString.PYTHON313 ref: 00007FFDA3542041
_Py_Dealloc.PYTHON313 ref: 00007FFDA3542133

Strings

TrusteeForm not yet supported, xrefs: 00007FFDA3542092
Trustee must be a dictionary containing {MultipleTrustee,MultipleTrusteeOperation,TrusteeForm,TrusteeType,Identifier}, xrefs: 00007FFDA3542037
The object is not a PySID object, xrefs: 00007FFDA35420FA
Identifier must be PySID object when TrusteeForm = TRUSTEE_IS_SID, xrefs: 00007FFDA354210A
llO|Ol, xrefs: 00007FFDA3541FF2
Identifier must be string/unicode when TrusteeForm = TRUSTEE_IS_NAME, xrefs: 00007FFDA35420C2
Invalid value for TrusteeForm, xrefs: 00007FFDA3542073

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Dealloc$Arg_Err_KeywordsParseStringTupleTuple_
String ID: Identifier must be PySID object when TrusteeForm = TRUSTEE_IS_SID$Identifier must be string/unicode when TrusteeForm = TRUSTEE_IS_NAME$Invalid value for TrusteeForm$The object is not a PySID object$Trustee must be a dictionary containing {MultipleTrustee,MultipleTrusteeOperation,TrusteeForm,TrusteeType,Identifier}$TrusteeForm not yet supported$llO|Ol
API String ID: 959004690-581804069
Opcode ID: e030765481a492b5f1dc0f46928bb67b82f3b6325f49a21945abdc45f2321e45
Instruction ID: d1268044e95b003fd096784c53d48017f1e03ec781559c914e10c858d936d1a8
Opcode Fuzzy Hash: e030765481a492b5f1dc0f46928bb67b82f3b6325f49a21945abdc45f2321e45
Instruction Fuzzy Hash: BD518E36B0AB8281EB268F19F46417973A7FB88790F444031CA8E57B26DF3EE545C748

Function 00007FFDA354D170 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

PyLong_AsVoidPtr.PYTHON313 ref: 00007FFDA354D19B
PyErr_Occurred.PYTHON313 ref: 00007FFDA354D1B2
PyErr_Clear.PYTHON313 ref: 00007FFDA354D1C1
PyUnicode_AsWideCharString.PYTHON313 ref: 00007FFDA354D1DC
PyMem_Free.PYTHON313 ref: 00007FFDA354D1EE
PyMem_Free.PYTHON313 ref: 00007FFDA354D21C
PyBuffer_Release.PYTHON313 ref: 00007FFDA354D23E
PyErr_SetString.PYTHON313 ref: 00007FFDA354D25E
PyObject_GetBuffer.PYTHON313 ref: 00007FFDA354D270
PyBuffer_Release.PYTHON313 ref: 00007FFDA354D291
PyErr_Format.PYTHON313 ref: 00007FFDA354D2AB
PyErr_Clear.PYTHON313 ref: 00007FFDA354D2D9
PyErr_Format.PYTHON313 ref: 00007FFDA354D309

Strings

WPARAM must be a unicode string, int, or buffer object (got %s), xrefs: 00007FFDA354D2F4
Buffer length can be at most %d characters, xrefs: 00007FFDA354D29E
Buffer cannot be None, xrefs: 00007FFDA354D254

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$Buffer_ClearFormatFreeMem_ReleaseString$BufferCharLong_Object_OccurredUnicode_VoidWide
String ID: Buffer cannot be None$Buffer length can be at most %d characters$WPARAM must be a unicode string, int, or buffer object (got %s)
API String ID: 3109676845-3026970096
Opcode ID: 638ec2c64d05b181e127cebc01ccb3966a1312f7bc25013f476e672dd9a6040d
Instruction ID: 41c92f6bf191ab792c31cdff0bbe267cdd49a343f246db441de381a86afa9ca1
Opcode Fuzzy Hash: 638ec2c64d05b181e127cebc01ccb3966a1312f7bc25013f476e672dd9a6040d
Instruction Fuzzy Hash: AB512321F0AB4281EF5A8F5DE46423867A2FF48B84F484031DA4E57B56DF3EE594C748

Function 00007FFDA3542150 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 103COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA3542188
PyErr_SetString.PYTHON313 ref: 00007FFDA35421AF
PyUnicode_FromWideChar.PYTHON313 ref: 00007FFDA35421FB
Py_BuildValue.PYTHON313 ref: 00007FFDA35422F5

Strings

TrusteeForm not yet supported, xrefs: 00007FFDA35421A5
MultipleTrusteeOperation, xrefs: 00007FFDA35422AC
TrusteeForm, xrefs: 00007FFDA35422E0
TrusteeType, xrefs: 00007FFDA35422CD
Identifier, xrefs: 00007FFDA35422A0
MultipleTrustee, xrefs: 00007FFDA35422B8
{s:O,s:l,s:l,s:l,s:N}, xrefs: 00007FFDA35422C2
Invalid value for TrusteeForm, xrefs: 00007FFDA354217E

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_String$BuildCharFromUnicode_ValueWide
String ID: Identifier$Invalid value for TrusteeForm$MultipleTrustee$MultipleTrusteeOperation$TrusteeForm$TrusteeForm not yet supported$TrusteeType${s:O,s:l,s:l,s:l,s:N}
API String ID: 2305401427-1816636059
Opcode ID: 11424eade5fed42f9f58899388f0ccfc8f6636113c6dcc90c7ab34a3f4ba7640
Instruction ID: 9fff346694330f46ccb673f62269ceba3b073dfd06897c5e8672eb7917f4d24a
Opcode Fuzzy Hash: 11424eade5fed42f9f58899388f0ccfc8f6636113c6dcc90c7ab34a3f4ba7640
Instruction Fuzzy Hash: 36419D35B0AB4286EB568F1DF86026973A2FB44B90F144131CA4E63B66DF3EF185C748

Function 00007FFDA36759CC Relevance: 27.1, APIs: 18, Instructions: 111COMMON

Download Yara Rule

APIs

X509_get_ext_d2i.LIBCRYPTO-3(00000000,00000000,00000000,00007FFDA36758D3), ref: 00007FFDA36759F2
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFDA3675A03
AUTHORITY_INFO_ACCESS_free.LIBCRYPTO-3 ref: 00007FFDA3675A10
PyList_New.PYTHON313 ref: 00007FFDA3675A38
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFDA3675A4F
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFDA3675A5E
OBJ_obj2nid.LIBCRYPTO-3 ref: 00007FFDA3675A6A
PyUnicode_FromStringAndSize.PYTHON313 ref: 00007FFDA3675A89
PyList_Append.PYTHON313 ref: 00007FFDA3675AA1
_Py_Dealloc.PYTHON313 ref: 00007FFDA3675AB8
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFDA3675AC8
AUTHORITY_INFO_ACCESS_free.LIBCRYPTO-3 ref: 00007FFDA3675AD5
PyList_Size.PYTHON313 ref: 00007FFDA3675ADE
_Py_Dealloc.PYTHON313 ref: 00007FFDA3675AFE
PyList_AsTuple.PYTHON313 ref: 00007FFDA3675B0C
_Py_Dealloc.PYTHON313 ref: 00007FFDA3675B23
AUTHORITY_INFO_ACCESS_free.LIBCRYPTO-3 ref: 00007FFDA3675B34
_Py_Dealloc.PYTHON313 ref: 00007FFDA3675B4D

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: DeallocList_$L_sk_numS_free$Size$AppendFromJ_obj2nidL_sk_valueStringTupleUnicode_X509_get_ext_d2i
String ID:
API String ID: 230305477-0
Opcode ID: 5f4787f238d784b37eba2f6d2076294fc9d45f18871587789bbf7c08a8189ad0
Instruction ID: e22be87f1457ef70eddf0a3bb5c704cd362b32a3550e6db1a731b2a643115bb4
Opcode Fuzzy Hash: 5f4787f238d784b37eba2f6d2076294fc9d45f18871587789bbf7c08a8189ad0
Instruction Fuzzy Hash: F0413321F0B64682FA549F22E97433923A2AF44F95F8C6474CE0E67756EF7EE4458308

Function 00007FFDA35496D0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32 ref: 00007FFDA35496E6
GetSidIdentifierAuthority.ADVAPI32 ref: 00007FFDA3549706
GetSidSubAuthorityCount.ADVAPI32 ref: 00007FFDA3549712
SetLastError.KERNEL32 ref: 00007FFDA3549737

Strings

0x%02hx%02hx%02hx%02hx%02hx%02hx, xrefs: 00007FFDA35497F3
-%lu, xrefs: 00007FFDA354985F
%lu, xrefs: 00007FFDA35497A2
S-%lu-, xrefs: 00007FFDA354974F

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Authority$CountErrorIdentifierLastValid
String ID: %lu$-%lu$0x%02hx%02hx%02hx%02hx%02hx%02hx$S-%lu-
API String ID: 228009767-531523367
Opcode ID: d6c7cb6490dbf970e67454a7506a052b5853455ff350a4c329918d20f5ccb460
Instruction ID: f450b06f6c38e7e09a5a16599d9f7a29034366511efebf42c9dd26ef4d576d77
Opcode Fuzzy Hash: d6c7cb6490dbf970e67454a7506a052b5853455ff350a4c329918d20f5ccb460
Instruction Fuzzy Hash: 4651E162B097D182DB128F2AB8642797BA2FB85B85F048035DE8E53716DE3EE148C704

Function 00007FFDA354ABB0 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

PyBytes_Size.PYTHON313 ref: 00007FFDA354ABE7
PyBytes_AsString.PYTHON313 ref: 00007FFDA354ABF3
PyErr_SetString.PYTHON313 ref: 00007FFDA354AC20
CoTaskMemAlloc.OLE32 ref: 00007FFDA354AC35
MultiByteToWideChar.KERNEL32 ref: 00007FFDA354AC5C
PyUnicode_AsWideCharString.PYTHON313 ref: 00007FFDA354AC7B
CoTaskMemAlloc.OLE32 ref: 00007FFDA354AC9B
memcpy.VCRUNTIME140 ref: 00007FFDA354ACB4
PyMem_Free.PYTHON313 ref: 00007FFDA354ACC3
PyErr_SetString.PYTHON313 ref: 00007FFDA354ACF3
PyErr_Format.PYTHON313 ref: 00007FFDA354AD1E

Strings

value is larger than a DWORD, xrefs: 00007FFDA354AC16
None is not a valid string in this context, xrefs: 00007FFDA354ACE9
Objects of type '%s' can not be converted to Unicode., xrefs: 00007FFDA354AD14
<NULL!!>, xrefs: 00007FFDA354AD06

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: String$Err_$AllocBytes_CharTaskWide$ByteFormatFreeMem_MultiSizeUnicode_memcpy
String ID: <NULL!!>$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.$value is larger than a DWORD
API String ID: 1531658785-4125661472
Opcode ID: 3347bce25c09ebf94e70747036ae54bb500433f39d5cdda55fb947e0f7a70fe8
Instruction ID: 72aaf49fbfb8e7a4d0b204bc00d49366e776d7dcb91eafbeede3cae26f73bbdc
Opcode Fuzzy Hash: 3347bce25c09ebf94e70747036ae54bb500433f39d5cdda55fb947e0f7a70fe8
Instruction Fuzzy Hash: 6E410E21B0BB4282EE9A8F1DE46427867A3BB44B81F444135D94E67756DF3EF544C348

Function 00007FFDA354AA10 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

PyBytes_Size.PYTHON313 ref: 00007FFDA354AA45
PyBytes_AsString.PYTHON313 ref: 00007FFDA354AA51
PyErr_SetString.PYTHON313 ref: 00007FFDA354AA7E
CoTaskMemAlloc.OLE32 ref: 00007FFDA354AA93
MultiByteToWideChar.KERNEL32 ref: 00007FFDA354AABA
PyUnicode_AsWideCharString.PYTHON313 ref: 00007FFDA354AAD9
CoTaskMemAlloc.OLE32 ref: 00007FFDA354AAF9
memcpy.VCRUNTIME140 ref: 00007FFDA354AB12
PyMem_Free.PYTHON313 ref: 00007FFDA354AB21
PyErr_SetString.PYTHON313 ref: 00007FFDA354AB51
PyErr_Format.PYTHON313 ref: 00007FFDA354AB7C

Strings

value is larger than a DWORD, xrefs: 00007FFDA354AA74
None is not a valid string in this context, xrefs: 00007FFDA354AB47
Objects of type '%s' can not be converted to Unicode., xrefs: 00007FFDA354AB72
<NULL!!>, xrefs: 00007FFDA354AB64

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: String$Err_$AllocBytes_CharTaskWide$ByteFormatFreeMem_MultiSizeUnicode_memcpy
String ID: <NULL!!>$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.$value is larger than a DWORD
API String ID: 1531658785-4125661472
Opcode ID: 168a535267c4d2021b12235baa8610be014cf2e5a84bacd634d05af756321a3e
Instruction ID: dec8b86cea07198540a6801c6031490ecd15dbdb0701502a9d81bfb3a8e2c35c
Opcode Fuzzy Hash: 168a535267c4d2021b12235baa8610be014cf2e5a84bacd634d05af756321a3e
Instruction Fuzzy Hash: EE410721B1AB4281EE56CF1EE46427877A3BB88B84F484035D94E67B52DF3EE544C748

Function 00007FFDA3541DD0 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

PyMapping_Check.PYTHON313 ref: 00007FFDA3541DFB
PyErr_SetString.PYTHON313 ref: 00007FFDA3541E16
PyMapping_Items.PYTHON313 ref: 00007FFDA3541E2C
PyDict_New.PYTHON313 ref: 00007FFDA3541E43
PySequence_Size.PYTHON313 ref: 00007FFDA3541E5F
PySequence_GetItem.PYTHON313 ref: 00007FFDA3541E77
PyTuple_GetItem.PYTHON313 ref: 00007FFDA3541E88
PyTuple_GetItem.PYTHON313 ref: 00007FFDA3541E96
PyDict_SetItem.PYTHON313 ref: 00007FFDA3541EA5
_Py_Dealloc.PYTHON313 ref: 00007FFDA3541EB9
PySequence_Size.PYTHON313 ref: 00007FFDA3541EC7
_Py_Dealloc.PYTHON313 ref: 00007FFDA3541EEA
PyErr_Clear.PYTHON313 ref: 00007FFDA3541F03

Strings

__dict__, xrefs: 00007FFDA3541F09
Object must be a mapping (dictionary, class instance, etc, xrefs: 00007FFDA3541E0C

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Item$Sequence_$DeallocDict_Err_Mapping_SizeTuple_$CheckClearItemsString
String ID: Object must be a mapping (dictionary, class instance, etc$__dict__
API String ID: 581612630-910247860
Opcode ID: 5d4b3b7ce0b7b16c71f8fdb79b69360d59f5c68d73fa31168451f9c5b6ef5398
Instruction ID: b6a9620db045669e1071d064a5520682a6d6f891c3ada7a12e0453e6b90879f5
Opcode Fuzzy Hash: 5d4b3b7ce0b7b16c71f8fdb79b69360d59f5c68d73fa31168451f9c5b6ef5398
Instruction Fuzzy Hash: 7F313225F0A74282EA168F1AE86422567A3EF45FC5F084030CE4F57B66DF3EF6958708

Function 00007FFDA3677694 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 74COMMON

Download Yara Rule

APIs

SSL_CTX_get_cert_store.LIBSSL-3 ref: 00007FFDA36776BF

Part of subcall function 00007FFDA3674844: X509_STORE_lock.LIBCRYPTO-3 ref: 00007FFDA3674851

PyErr_SetString.PYTHON313 ref: 00007FFDA36776E6
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFDA36776F8
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFDA3677707
X509_OBJECT_get_type.LIBCRYPTO-3 ref: 00007FFDA3677713
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFDA3677747
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFDA367775B
Py_BuildValue.PYTHON313 ref: 00007FFDA367778D

Strings

x509, xrefs: 00007FFDA367777F
failed to query cert store, xrefs: 00007FFDA36776DC
x509_ca, xrefs: 00007FFDA3677761
{sisisi}, xrefs: 00007FFDA3677786
crl, xrefs: 00007FFDA3677771

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: L_sk_numX509_$BuildE_lockErr_L_sk_pop_freeL_sk_valueStringT_get_typeValueX_get_cert_store
String ID: crl$failed to query cert store$x509$x509_ca${sisisi}
API String ID: 2783361091-466295505
Opcode ID: 210b12b46044572f4f71ec99b46b66d010804930581be482105c05b28423a3dc
Instruction ID: 6b824062f484e53d2860431d5639a222713b3624325f4818ccd74a7d76b23659
Opcode Fuzzy Hash: 210b12b46044572f4f71ec99b46b66d010804930581be482105c05b28423a3dc
Instruction Fuzzy Hash: 7F314325B0A74382FA108F15A86817977A2FF84F94F9C3435D94E67366DF3EE0498708

Function 00007FFDA3672724 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

OpenSSL_version_num.LIBCRYPTO-3 ref: 00007FFDA3672736
PyLong_FromUnsignedLong.PYTHON313 ref: 00007FFDA3672740
PyModule_Add.PYTHON313 ref: 00007FFDA3672753
Py_BuildValue.PYTHON313 ref: 00007FFDA3672791
PyModule_Add.PYTHON313 ref: 00007FFDA36727A4
OpenSSL_version.LIBCRYPTO-3 ref: 00007FFDA36727B0
PyUnicode_FromString.PYTHON313 ref: 00007FFDA36727B9
PyModule_Add.PYTHON313 ref: 00007FFDA36727CC
Py_BuildValue.PYTHON313 ref: 00007FFDA36727F2
PyModule_Add.PYTHON313 ref: 00007FFDA3672805

Strings

OPENSSL_VERSION, xrefs: 00007FFDA36727BF
OPENSSL_VERSION_INFO, xrefs: 00007FFDA3672797
_OPENSSL_API_VERSION, xrefs: 00007FFDA36727F8
IIIII, xrefs: 00007FFDA367277A, 00007FFDA36727EB
OPENSSL_VERSION_NUMBER, xrefs: 00007FFDA3672746

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Module_$BuildFromOpenValue$L_versionL_version_numLongLong_StringUnicode_Unsigned
String ID: IIIII$OPENSSL_VERSION$OPENSSL_VERSION_INFO$OPENSSL_VERSION_NUMBER$_OPENSSL_API_VERSION
API String ID: 2199365590-595941748
Opcode ID: 5d847c3aa5937299440ca4f194db71bda3ca08f796674df5844a2f2570db2675
Instruction ID: ee55286433e7e3b209031aa7aaa58e845f5c01285a68ce0a5607a7d6af7592b6
Opcode Fuzzy Hash: 5d847c3aa5937299440ca4f194db71bda3ca08f796674df5844a2f2570db2675
Instruction Fuzzy Hash: 6121E461F1A71382FB108B61F8645293762FF45BC4BC82536C90E6BB66EF7EE1488704

Function 00007FFDA3543030 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON313 ref: 00007FFDA35430A6
PyErr_SetString.PYTHON313 ref: 00007FFDA354310D
GetLastError.KERNEL32 ref: 00007FFDA3543174
GetLengthSid.ADVAPI32 ref: 00007FFDA3543190
PyErr_Format.PYTHON313 ref: 00007FFDA35431BB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35431CB
PyErr_Format.PYTHON313 ref: 00007FFDA35431F0
memset.VCRUNTIME140 ref: 00007FFDA3543203
memcpy.VCRUNTIME140 ref: 00007FFDA3543213
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3543278

Part of subcall function 00007FFDA354C400: GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C41B
Part of subcall function 00007FFDA354C400: FormatMessageW.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C48A
Part of subcall function 00007FFDA354C400: PyUnicode_DecodeMBCS.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C568
Part of subcall function 00007FFDA354C400: Py_BuildValue.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C57D
Part of subcall function 00007FFDA354C400: LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C595
Part of subcall function 00007FFDA354C400: PyErr_SetObject.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C5AA

Strings

The object is not a PySID object, xrefs: 00007FFDA3543103
%s not supported by this version of Windows, xrefs: 00007FFDA354309C
%s: adding ACE would put ACL over size limit, xrefs: 00007FFDA35431AE
%s: unable to allocated %d bytes, xrefs: 00007FFDA35431E0

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$Format$ErrorLast$BuildDecodeFreeLengthLocalMessageObjectStringUnicode_Valuefreemallocmemcpymemset
String ID: %s not supported by this version of Windows$%s: adding ACE would put ACL over size limit$%s: unable to allocated %d bytes$The object is not a PySID object
API String ID: 2123223808-1709335586
Opcode ID: 23f19527f0bff15d9e74990f0f1674cade0e525a7b8c2d2658d9cfa4f814197a
Instruction ID: 9dbe6db21c2c81530aeb63ffdb15fc13d928a1e3a5730ce68a2e79cd34dd05be
Opcode Fuzzy Hash: 23f19527f0bff15d9e74990f0f1674cade0e525a7b8c2d2658d9cfa4f814197a
Instruction Fuzzy Hash: DD61A721B1E74281EF269B1AE86027967A3BF88BC4F444031ED4E57B66DF3DE515C708

Function 00007FFDA354CC60 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 52COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLongLong.PYTHON313 ref: 00007FFDA354CC7F
PyLong_FromUnsignedLongLong.PYTHON313 ref: 00007FFDA354CC8C
PyLong_FromUnsignedLongLong.PYTHON313 ref: 00007FFDA354CC99
PyLong_FromUnsignedLongLong.PYTHON313 ref: 00007FFDA354CCA6
PyLong_FromUnsignedLongLong.PYTHON313 ref: 00007FFDA354CCB3
PyLong_FromUnsignedLongLong.PYTHON313 ref: 00007FFDA354CCBF
Py_BuildValue.PYTHON313 ref: 00007FFDA354CD26

Strings

OtherOperationCount, xrefs: 00007FFDA354CD10
{s:N,s:N,s:N,s:N,s:N,s:N}, xrefs: 00007FFDA354CCE7
WriteTransferCount, xrefs: 00007FFDA354CCF3
WriteOperationCount, xrefs: 00007FFDA354CCCA
OtherTransferCount, xrefs: 00007FFDA354CCDB
ReadTransferCount, xrefs: 00007FFDA354CCFF
ReadOperationCount, xrefs: 00007FFDA354CCD4

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Long$FromLong_Unsigned$BuildValue
String ID: OtherOperationCount$OtherTransferCount$ReadOperationCount$ReadTransferCount$WriteOperationCount$WriteTransferCount${s:N,s:N,s:N,s:N,s:N,s:N}
API String ID: 3891383402-408589094
Opcode ID: 4ee5e6750fb859370a58b46a6f2f982fc0eabf7e348b4551c1477cedafe3e123
Instruction ID: 4ca711e52716ad6b93f69afac59fb577bc98b4692a20495454026991fe85b58a
Opcode Fuzzy Hash: 4ee5e6750fb859370a58b46a6f2f982fc0eabf7e348b4551c1477cedafe3e123
Instruction Fuzzy Hash: A0213936A0AB4282DA01CF55F89445977B5FB88BD1B520132EE9E53725EF3EE145CB04

Function 00007FFDA3542C70 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 133COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA3542CF6

Strings

The object is not a PySID object, xrefs: 00007FFDA3542CEC
%s not supported by this version of Windows, xrefs: 00007FFDA3542C99
%s: adding ACE would put ACL over size limit, xrefs: 00007FFDA3542D90
%s: unable to allocated %d bytes, xrefs: 00007FFDA3542DC2

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_String
String ID: %s not supported by this version of Windows$%s: adding ACE would put ACL over size limit$%s: unable to allocated %d bytes$The object is not a PySID object
API String ID: 1450464846-1709335586
Opcode ID: a1e77c7967686f55aa96d559abd8a6b890d2a3f689a11bfbc787306795e293e7
Instruction ID: 5abb6feb38dc68392d0981cf38e69f499360e7bc3eb9758b0644cc10f35e0a41
Opcode Fuzzy Hash: a1e77c7967686f55aa96d559abd8a6b890d2a3f689a11bfbc787306795e293e7
Instruction Fuzzy Hash: 3E516425B0EB5281EB1A9B1AF86013A77A3BF84FC4F444031DD4E67B66DE3EE5058708

Function 00007FFDA3542920 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 132COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA35429A0

Strings

The object is not a PySID object, xrefs: 00007FFDA3542996
%s not supported by this version of Windows, xrefs: 00007FFDA354294E
%s: adding ACE would put ACL over size limit, xrefs: 00007FFDA3542A29
%s: unable to allocated %d bytes, xrefs: 00007FFDA3542A5B

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_String
String ID: %s not supported by this version of Windows$%s: adding ACE would put ACL over size limit$%s: unable to allocated %d bytes$The object is not a PySID object
API String ID: 1450464846-1709335586
Opcode ID: acd72d126dd04e3d366b3d57bba94e5d2814d11e261c2ab172a574c504a94f1b
Instruction ID: 867d0f87513b9d969bc208c46a58ea59996990f25cab03c032fe5572e19a20c4
Opcode Fuzzy Hash: acd72d126dd04e3d366b3d57bba94e5d2814d11e261c2ab172a574c504a94f1b
Instruction Fuzzy Hash: 4F519025F0A75282EA1A9B5BB87003977A3BF85FC4F444031DD4E67BA6DE3EE5458308

Function 00007FFDA3547950 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

IsValidSecurityDescriptor.ADVAPI32(?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA3547960
PyErr_SetString.PYTHON313(?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354797B
GetSecurityDescriptorLength.ADVAPI32(?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA3547996
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA35479A4
MakeSelfRelativeSD.ADVAPI32(?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA35479BD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA35479CE
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA35479DE
PyErr_Format.PYTHON313(?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA3547A02

Strings

MakeSelfRelativeSD, xrefs: 00007FFDA3547A41
Invalid Security descriptor, xrefs: 00007FFDA3547971
Unable to allocate %d bytes, xrefs: 00007FFDA35479F3

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: DescriptorErr_Securitymalloc$FormatLengthMakeRelativeSelfStringValidfree
String ID: Invalid Security descriptor$MakeSelfRelativeSD$Unable to allocate %d bytes
API String ID: 1101611553-2210018374
Opcode ID: ac73de6e39ddeed083d98a8888cc15b10e7ce052d5d07b96d89372fbc4ae9b04
Instruction ID: ae8763e79a9fd88ea08729a54f3f8d15fb7d8f6e7e8e5eca10b97e12960fe1a4
Opcode Fuzzy Hash: ac73de6e39ddeed083d98a8888cc15b10e7ce052d5d07b96d89372fbc4ae9b04
Instruction Fuzzy Hash: E6316821F1AB4182EF458B2AF46423963A2FF88B84F444031DA5F57759DF3EE5458708

Function 00007FFDA3541BE0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 127COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3541C4E
PyErr_Format.PYTHON313 ref: 00007FFDA3541C70

Strings

Error reordering ACL: Unable to allocate acl of size %d, xrefs: 00007FFDA3541C63
Ace type %d is not supported yet, xrefs: 00007FFDA3541DA4
ReorderACL, xrefs: 00007FFDA3541DBB

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_Formatmalloc
String ID: Ace type %d is not supported yet$Error reordering ACL: Unable to allocate acl of size %d$ReorderACL
API String ID: 1659041409-545600788
Opcode ID: 80076816f9a1870518144f9e70f1a9ffdbb8e573a704e52155d4e8cf1921dfc3
Instruction ID: bb8d15ccc4d7cf99e0430f9df1662f817794ada49c5011cb057952eed6f90f02
Opcode Fuzzy Hash: 80076816f9a1870518144f9e70f1a9ffdbb8e573a704e52155d4e8cf1921dfc3
Instruction Fuzzy Hash: 1B51C661F0D79281E7268F2AA42027ABBA3FB85F80F545035DD8E63B56CE3EE145C744

Function 00007FFDA3546BF0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 113COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA3546C1E
PyUnicode_AsUTF8.PYTHON313 ref: 00007FFDA3546C3F
_Py_Dealloc.PYTHON313 ref: 00007FFDA3546CE3

Strings

InternalHigh, xrefs: 00007FFDA3546D4F
Internal, xrefs: 00007FFDA3546D20
The object is not a PyHANDLE object, xrefs: 00007FFDA3546CAF
can't delete OVERLAPPED attributes, xrefs: 00007FFDA3546C14
hEvent, xrefs: 00007FFDA3546C53

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: DeallocErr_StringUnicode_
String ID: Internal$InternalHigh$The object is not a PyHANDLE object$can't delete OVERLAPPED attributes$hEvent
API String ID: 3427960318-2811562281
Opcode ID: 6f9bae75d1a21e5200ff923e5a1191e3a43b0791db843c6bce82305bf55956a3
Instruction ID: 2e3f17b435d80c15754e6cc94403db7eb5ccd8284c903c38bb0ce3a7e927d47d
Opcode Fuzzy Hash: 6f9bae75d1a21e5200ff923e5a1191e3a43b0791db843c6bce82305bf55956a3
Instruction Fuzzy Hash: A3515261B0EB4281EA9A8B2EE46027963A3FF45B84F144131DA4E67796DF3EF5548308

Function 00007FFDA3675B5C Relevance: 21.1, APIs: 14, Instructions: 101COMMON

Download Yara Rule

APIs

X509_get_ext_d2i.LIBCRYPTO-3(?,?,00000000,00007FFDA3675974), ref: 00007FFDA3675B83
PyList_New.PYTHON313(?,?,00000000,00007FFDA3675974), ref: 00007FFDA3675B9F
OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFDA3675974), ref: 00007FFDA3675BB7
OPENSSL_sk_value.LIBCRYPTO-3(?,?,00000000,00007FFDA3675974), ref: 00007FFDA3675BCB
OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFDA3675974), ref: 00007FFDA3675BE3
OPENSSL_sk_value.LIBCRYPTO-3(?,?,00000000,00007FFDA3675974), ref: 00007FFDA3675BF3
PyUnicode_FromStringAndSize.PYTHON313(?,?,00000000,00007FFDA3675974), ref: 00007FFDA3675C09
PyList_Append.PYTHON313(?,?,00000000,00007FFDA3675974), ref: 00007FFDA3675C1D
_Py_Dealloc.PYTHON313(?,?,00000000,00007FFDA3675974), ref: 00007FFDA3675C33
OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFDA3675974), ref: 00007FFDA3675C44
OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFDA3675974), ref: 00007FFDA3675C55
PyList_AsTuple.PYTHON313(?,?,00000000,00007FFDA3675974), ref: 00007FFDA3675C6D
_Py_Dealloc.PYTHON313(?,?,00000000,00007FFDA3675974), ref: 00007FFDA3675C8D
CRL_DIST_POINTS_free.LIBCRYPTO-3(?,?,00000000,00007FFDA3675974), ref: 00007FFDA3675C96

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: L_sk_num$List_$DeallocL_sk_value$AppendFromS_freeSizeStringTupleUnicode_X509_get_ext_d2i
String ID:
API String ID: 3668485020-0
Opcode ID: d903ec9832bbd2f6dd33dbfaa78e45da9855e2f592df6336c9e26f94e30de93d
Instruction ID: 09e3ab0bcc5862ec325455136a5d4a8f7720fbf67c3ae15d2fa8f48aa0925fbc
Opcode Fuzzy Hash: d903ec9832bbd2f6dd33dbfaa78e45da9855e2f592df6336c9e26f94e30de93d
Instruction Fuzzy Hash: 7D414431B0BA0685FA549F22A9743352362BF45F95F8C6474CE0F26756DF3EE4498308

Function 00007FFDA354AD90 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA354ADCF
PyUnicode_AsMBCSString.PYTHON313 ref: 00007FFDA354AE01
PyErr_Format.PYTHON313 ref: 00007FFDA354AE38

Strings

Expected 'bytes', got '%s', xrefs: 00007FFDA354AE2A
value is larger than a DWORD, xrefs: 00007FFDA354AE73
None is not a valid string in this context, xrefs: 00007FFDA354ADC5

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_String$FormatUnicode_
String ID: Expected 'bytes', got '%s'$None is not a valid string in this context$value is larger than a DWORD
API String ID: 744494611-3495899980
Opcode ID: 642d062dd71c2c3f8c7481d2541cfedb3f89497689dab01917ab17cc1366d4e1
Instruction ID: 43234a97eba60ee7046f0f02d54a6c36d1e9d947b94ef8bae83702984ba452b8
Opcode Fuzzy Hash: 642d062dd71c2c3f8c7481d2541cfedb3f89497689dab01917ab17cc1366d4e1
Instruction Fuzzy Hash: BA416121F0BB4285EA96CF1EE82417967A3BF48BC0F194031D91E67B56DE3EE594C348

Function 00007FFDA354B040 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

PyUnicode_AsWideCharString.PYTHON313 ref: 00007FFDA354B080
PyErr_SetString.PYTHON313 ref: 00007FFDA354B0B3
PyMem_Free.PYTHON313 ref: 00007FFDA354B0C3
SysAllocStringLen.OLEAUT32 ref: 00007FFDA354B0DD
PyMem_Free.PYTHON313 ref: 00007FFDA354B0F0
SysStringLen.OLEAUT32 ref: 00007FFDA354B114
PyErr_SetString.PYTHON313 ref: 00007FFDA354B13F
PyErr_Format.PYTHON313 ref: 00007FFDA354B16A

Strings

value is larger than a DWORD, xrefs: 00007FFDA354B0A9
None is not a valid string in this context, xrefs: 00007FFDA354B135
Objects of type '%s' can not be converted to Unicode., xrefs: 00007FFDA354B160
<NULL!!>, xrefs: 00007FFDA354B152

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: String$Err_$FreeMem_$AllocCharFormatUnicode_Wide
String ID: <NULL!!>$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.$value is larger than a DWORD
API String ID: 2830890580-4125661472
Opcode ID: 2f2fd1bd077cf4d9f48c6f4d287ef1593a6289a2c9030374ace75b4ff9283679
Instruction ID: df1ec53a2e1bf9cac12bc8711f91658c72e46e3f43dcfbd7b2c40d1d00e7775e
Opcode Fuzzy Hash: 2f2fd1bd077cf4d9f48c6f4d287ef1593a6289a2c9030374ace75b4ff9283679
Instruction Fuzzy Hash: 52317131B0AB8282EF568F19E46023967A2FF88BD0F444131DA8E63B56DF3DE545C708

Function 00007FFDA3673FC8 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA3673FF2
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFDA3674002
RAND_bytes.LIBCRYPTO-3 ref: 00007FFDA3674016

Strings

num must be positive, xrefs: 00007FFDA3673FE8
(ks), xrefs: 00007FFDA367404C

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: String$Bytes_D_bytesErr_FromSize
String ID: (ks)$num must be positive
API String ID: 574210595-3708576348
Opcode ID: b7e4ef26f4134154d151b764a8479846e705c9ca53a204c3a9fce73e237e3f66
Instruction ID: d2ab1a83180fbecb2bd8751abfc2b38aaf0e40dd05172fda226d45c94b247714
Opcode Fuzzy Hash: b7e4ef26f4134154d151b764a8479846e705c9ca53a204c3a9fce73e237e3f66
Instruction Fuzzy Hash: E7214725F0A612C1FB158F21E97813823A6BF48F94F8C6431C90E66766DF3EE4458348

Function 00007FFDA367C2AC Relevance: 19.6, APIs: 13, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CertGetEnhancedKeyUsage.CRYPT32 ref: 00007FFDA367C2CB
PyMem_Malloc.PYTHON313(?,00007FFDA367A923), ref: 00007FFDA367C2D9
PyErr_NoMemory.PYTHON313(?,00007FFDA367A923), ref: 00007FFDA367C2E7
CertGetEnhancedKeyUsage.CRYPT32 ref: 00007FFDA367C30C
PyMem_Free.PYTHON313(?,00007FFDA367A923), ref: 00007FFDA367C319
GetLastError.KERNEL32(?,00007FFDA367A923), ref: 00007FFDA367C31F
PyFrozenSet_New.PYTHON313(?,00007FFDA367A923), ref: 00007FFDA367C33A
PyUnicode_FromString.PYTHON313(?,00007FFDA367A923), ref: 00007FFDA367C35B
PySet_Add.PYTHON313(?,00007FFDA367A923), ref: 00007FFDA367C36F
_Py_Dealloc.PYTHON313(?,00007FFDA367A923), ref: 00007FFDA367C386
PyMem_Free.PYTHON313(?,00007FFDA367A923), ref: 00007FFDA367C3B2

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Mem_$CertEnhancedFreeSet_Usage$DeallocErr_ErrorFromFrozenLastMallocMemoryStringUnicode_
String ID:
API String ID: 2458427691-0
Opcode ID: 2cd6634cda7950ea608b26807c57f45d5ce5584d3dae50a6d6ae09d557c1b1f0
Instruction ID: 72ad632ce6c6c436b8fd6c4d346eeb8f82b561bde1251bc2a2252ccc9aed0e21
Opcode Fuzzy Hash: 2cd6634cda7950ea608b26807c57f45d5ce5584d3dae50a6d6ae09d557c1b1f0
Instruction Fuzzy Hash: 79317431B0BA02C1FB549F65A46453C63A2BF84BA4F8C2435D95E62792DF3FE4498308

Function 00007FFDA354C400 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 133windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C41B
FormatMessageW.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C48A
PyUnicode_FromWideChar.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C549
PyUnicode_DecodeMBCS.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C568
Py_BuildValue.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C57D
LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C595
PyErr_SetObject.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C5AA
_Py_Dealloc.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C5BE

Strings

ignore, xrefs: 00007FFDA354C55B
No error message is available, xrefs: 00007FFDA354C49A
(iNN), xrefs: 00007FFDA354C571

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Unicode_$BuildCharDeallocDecodeErr_ErrorFormatFreeFromLastLocalMessageObjectValueWide
String ID: (iNN)$No error message is available$ignore
API String ID: 3492665310-37674240
Opcode ID: 89342b33277597b3a4676ff5a8e6ea240fe01a07b6f10a9c172c7993dd11e9a3
Instruction ID: a1f7368d84ace5d26f9d2feaf092f269051268fe4544d356d2519a36f8077b18
Opcode Fuzzy Hash: 89342b33277597b3a4676ff5a8e6ea240fe01a07b6f10a9c172c7993dd11e9a3
Instruction Fuzzy Hash: FB51A121F0A64291EE1A8F1DE46027963A3FFC5B80F484131DA4F67796DF3EE4428308

Function 00007FFDA367C7B8 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 97COMMON

Download Yara Rule

APIs

PyArg_Parse.PYTHON313 ref: 00007FFDA367C7EB
PyErr_SetString.PYTHON313 ref: 00007FFDA367C81D
PyErr_Format.PYTHON313 ref: 00007FFDA367C887
PyErr_WarnEx.PYTHON313 ref: 00007FFDA367C8B5
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFDA367C915

Strings

ssl.TLSVersion.TLSv1_1 is deprecated, xrefs: 00007FFDA367C88F
Unsupported protocol version 0x%x, xrefs: 00007FFDA367C924
Unsupported TLS/SSL version 0x%x, xrefs: 00007FFDA367C876
ssl.TLSVersion.TLSv1 is deprecated, xrefs: 00007FFDA367C898
The context's protocol doesn't support modification of highest and lowest version., xrefs: 00007FFDA367C813
ssl.TLSVersion.SSLv3 is deprecated, xrefs: 00007FFDA367C8A1

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Err_$Arg_FormatParseStringWarnX_ctrl
String ID: The context's protocol doesn't support modification of highest and lowest version.$Unsupported TLS/SSL version 0x%x$Unsupported protocol version 0x%x$ssl.TLSVersion.SSLv3 is deprecated$ssl.TLSVersion.TLSv1 is deprecated$ssl.TLSVersion.TLSv1_1 is deprecated
API String ID: 3279334173-3879554506
Opcode ID: 91ac4c308643b8c7215cc0744572f8430fb83311e0c191197f64f9fa85b5f0ab
Instruction ID: 788e5c8f807752d303a0e19138d4563268793a4949705e405caf8a34d468f5bf
Opcode Fuzzy Hash: 91ac4c308643b8c7215cc0744572f8430fb83311e0c191197f64f9fa85b5f0ab
Instruction Fuzzy Hash: 2F418221B1E51286FA718F19D4745392B62AF45B80FEC7231C51D62BE6CF2FE9448708

Function 00007FFDA3676374 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PyUnicode_AsUTF8String.PYTHON313(?,?,?,00007FFDA36762E0), ref: 00007FFDA36763A4
PyErr_Format.PYTHON313(?,?,?,00007FFDA36762E0), ref: 00007FFDA3676419
PyMem_Free.PYTHON313(?,?,?,00007FFDA36762E0), ref: 00007FFDA3676425
PyMem_Malloc.PYTHON313(?,?,?,00007FFDA36762E0), ref: 00007FFDA367642E
PyErr_SetString.PYTHON313(?,?,?,00007FFDA36762E0), ref: 00007FFDA367644E
_Py_Dealloc.PYTHON313(?,?,?,00007FFDA36762E0), ref: 00007FFDA3676467
memcpy.VCRUNTIME140(?,?,?,00007FFDA36762E0), ref: 00007FFDA3676478
_Py_Dealloc.PYTHON313(?,?,?,00007FFDA36762E0), ref: 00007FFDA3676494
PyErr_SetString.PYTHON313(?,?,?,00007FFDA36762E0), ref: 00007FFDA36764AE

Strings

unable to allocate password buffer, xrefs: 00007FFDA3676444
password cannot be longer than %d bytes, xrefs: 00007FFDA367640F

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Err_String$DeallocMem_$FormatFreeMallocUnicode_memcpy
String ID: password cannot be longer than %d bytes$unable to allocate password buffer
API String ID: 1570515377-2395793021
Opcode ID: a0670d9b12e7f607e22c3cafcb4cfb255c0c9d6039909e018bc8a60c94961bbe
Instruction ID: ccbf9445a6fa1fca31568d667c6c5a547180bb147118e5d2789fe89e0b3ff669
Opcode Fuzzy Hash: a0670d9b12e7f607e22c3cafcb4cfb255c0c9d6039909e018bc8a60c94961bbe
Instruction Fuzzy Hash: 9F414F21F0AA42C1FA549F16D56417963A2FF44F94F9CA431CA4E2779ADF3EE4498308

Function 00007FFDA354CEB0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

PyNumber_Long.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEC5
PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CED3
PyLong_AsLongLong.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEE1
PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEF0
PyErr_Clear.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEFB
PyLong_AsUnsignedLongLong.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF04
PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF13
_Py_Dealloc.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF2C
PyErr_Format.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF4B
_Py_Dealloc.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF71

Strings

Unable to convert %s to pointer-sized value, xrefs: 00007FFDA354CF36

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_Long$Occurred$DeallocLong_$ClearFormatNumber_Unsigned
String ID: Unable to convert %s to pointer-sized value
API String ID: 1465853305-2431006615
Opcode ID: 57e26dbec32f2f369f39d670887e51803981aee692bf8c45d946dd112ecbf49d
Instruction ID: c04d4da8989e7927aeb6665514fd71a89c5f495decb2588bbf9d5aac33168991
Opcode Fuzzy Hash: 57e26dbec32f2f369f39d670887e51803981aee692bf8c45d946dd112ecbf49d
Instruction Fuzzy Hash: CF217431F0BB0291EF064F69E46413427A2AF45BA5F040230D92F227D6DF3EF1458704

Function 00007FFDA354C110 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 38threadmemoryCOMMON

Download Yara Rule

APIs

PyThreadState_Swap.PYTHON313 ref: 00007FFDA354C120
_Py_FatalErrorFunc.PYTHON313 ref: 00007FFDA354C13C
PyThreadState_Swap.PYTHON313 ref: 00007FFDA354C14E
LocalAlloc.KERNEL32 ref: 00007FFDA354C161
_Py_FatalErrorFunc.PYTHON313 ref: 00007FFDA354C17D
TlsSetValue.KERNEL32 ref: 00007FFDA354C18D
PyThreadState_Swap.PYTHON313 ref: 00007FFDA354C195
PyThreadState_Swap.PYTHON313 ref: 00007FFDA354C1A1

Strings

pywintypes: can not setup interpreter state, as current state is invalid, xrefs: 00007FFDA354C12E
Out of memory allocating thread state., xrefs: 00007FFDA354C16F
PyWinInterpreterState_Ensure, xrefs: 00007FFDA354C135, 00007FFDA354C176

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: State_SwapThread$ErrorFatalFunc$AllocLocalValue
String ID: Out of memory allocating thread state.$PyWinInterpreterState_Ensure$pywintypes: can not setup interpreter state, as current state is invalid
API String ID: 4234957216-1490924957
Opcode ID: ea76954ba2b931e15fda9edfbedd9c8b0e85c06434b3c3fd715313b2e18efd7a
Instruction ID: a46546e0e14feafc7e42bf941daf5e69b8648df27b96cca0096d40cd37bd0ebd
Opcode Fuzzy Hash: ea76954ba2b931e15fda9edfbedd9c8b0e85c06434b3c3fd715313b2e18efd7a
Instruction Fuzzy Hash: 0811A424F0AB4396EF1A9B28E86422927A2BF44B56F441435C54E22766DF3EF654C308

Function 00007FFDA3678268 Relevance: 18.1, APIs: 12, Instructions: 71threadCOMMON

Download Yara Rule

APIs

_Py_fopen_obj.PYTHON313 ref: 00007FFDA3678291
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA367829F
PyEval_SaveThread.PYTHON313 ref: 00007FFDA36782A8
PEM_read_DHparams.LIBCRYPTO-3 ref: 00007FFDA36782BC
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDA36782C8
PyEval_RestoreThread.PYTHON313 ref: 00007FFDA36782D1
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA36782DC
PyErr_SetFromErrnoWithFilenameObject.PYTHON313 ref: 00007FFDA36782F3
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA36782F9
SSL_CTX_ctrl.LIBSSL-3 ref: 00007FFDA3678342
DH_free.LIBCRYPTO-3 ref: 00007FFDA367834F
DH_free.LIBCRYPTO-3 ref: 00007FFDA367836D

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Eval_H_freeThread_errno$Err_ErrnoFilenameFromHparamsM_read_ObjectPy_fopen_objR_clear_errorRestoreSaveWithX_ctrlfclose
String ID:
API String ID: 1346594628-0
Opcode ID: afa238874eb3aa792ad155579ee5bdd9c70baf79b46d895c036ba73493ed3cf6
Instruction ID: 00b010022c0ec058822124030a2bb2041f9234d0c281ab061adc7ec15a8ecda9
Opcode Fuzzy Hash: afa238874eb3aa792ad155579ee5bdd9c70baf79b46d895c036ba73493ed3cf6
Instruction Fuzzy Hash: BC316435B1AA4182F7109B66E8255297362FF88F85F8C6430CE4D57B66DF3EE449C708

Function 00007FFDA354CA90 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 89timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32 ref: 00007FFDA354CACD
FileTimeToSystemTime.KERNEL32 ref: 00007FFDA354CAFF
FileTimeToSystemTime.KERNEL32 ref: 00007FFDA354CB32
PyLong_FromUnsignedLong.PYTHON313 ref: 00007FFDA354CB6B
PyLong_FromUnsignedLong.PYTHON313 ref: 00007FFDA354CB78
PyLong_FromUnsignedLong.PYTHON313 ref: 00007FFDA354CB85
PyLong_FromUnsignedLong.PYTHON313 ref: 00007FFDA354CB92
Py_BuildValue.PYTHON313 ref: 00007FFDA354CBD0

Part of subcall function 00007FFDA354C400: GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C41B
Part of subcall function 00007FFDA354C400: FormatMessageW.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C48A
Part of subcall function 00007FFDA354C400: PyUnicode_DecodeMBCS.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C568
Part of subcall function 00007FFDA354C400: Py_BuildValue.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C57D
Part of subcall function 00007FFDA354C400: LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C595
Part of subcall function 00007FFDA354C400: PyErr_SetObject.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C5AA

Part of subcall function 00007FFDA354A400: PyObject_GetAttrString.PYTHON313(?,?,?,?,?,?,?,?,?,00007FFDA3549C6D), ref: 00007FFDA354A444
Part of subcall function 00007FFDA354A400: _Py_Dealloc.PYTHON313(?,?,?,?,?,?,?,?,?,00007FFDA3549C6D), ref: 00007FFDA354A4A8

Strings

FileTimeToSystemTime, xrefs: 00007FFDA354CAD9, 00007FFDA354CB0B, 00007FFDA354CB3E
lNNNNNNNuu, xrefs: 00007FFDA354CB9B

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Time$FromLongLong_Unsigned$FileSystem$BuildValue$AttrDeallocDecodeErr_ErrorFormatFreeLastLocalMessageObjectObject_StringUnicode_
String ID: FileTimeToSystemTime$lNNNNNNNuu
API String ID: 3509019891-4021486075
Opcode ID: e012cac86467e09425fc3eb86c788589e93cbae2027880d1750f8e61441089dd
Instruction ID: de367b49a8a1792145af6e2ed2a69c28637ae2719bfd6f31232c27066f9212bf
Opcode Fuzzy Hash: e012cac86467e09425fc3eb86c788589e93cbae2027880d1750f8e61441089dd
Instruction Fuzzy Hash: 7D41C136B0AB4191EB12DB19F8645AA73A6FB88784F814032DE8E53756DF3DF146C704

Function 00007FFDA354B1A0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 74COMMON

Download Yara Rule

APIs

PyUnicode_AsWideCharString.PYTHON313 ref: 00007FFDA354B1DA
PyErr_SetString.PYTHON313 ref: 00007FFDA354B1F9
PyErr_SetString.PYTHON313 ref: 00007FFDA354B24D
PyErr_SetString.PYTHON313 ref: 00007FFDA354B27F

Strings

value is larger than a DWORD, xrefs: 00007FFDA354B243
None is not a valid string in this context, xrefs: 00007FFDA354B275
Getting WCHAR string, xrefs: 00007FFDA354B1EF
Objects of type '%s' can not be converted to Unicode., xrefs: 00007FFDA354B2A0
<NULL!!>, xrefs: 00007FFDA354B292

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: String$Err_$CharUnicode_Wide
String ID: <NULL!!>$Getting WCHAR string$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.$value is larger than a DWORD
API String ID: 3849944921-1275048830
Opcode ID: b0e8982cd879d59a9668f92adfe5365474881f42431a1bc4517e5c5527a76195
Instruction ID: ac50510ebb45ceca300bb7374f7663cca03d5b48accadab3613fc01629c4d797
Opcode Fuzzy Hash: b0e8982cd879d59a9668f92adfe5365474881f42431a1bc4517e5c5527a76195
Instruction Fuzzy Hash: 7F315031B0EB4282EF56CF5EF4A012867A2FB88BC4F444031DA4E67B66DF2EE5448744

Function 00007FFDA354C030 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON313 ref: 00007FFDA354C04C
PyErr_Clear.PYTHON313 ref: 00007FFDA354C05A
PyCallable_Check.PYTHON313 ref: 00007FFDA354C06E
PyObject_CallObject.PYTHON313 ref: 00007FFDA354C07D
_Py_Dealloc.PYTHON313 ref: 00007FFDA354C094
_Py_Dealloc.PYTHON313 ref: 00007FFDA354C0CF
PyErr_Clear.PYTHON313 ref: 00007FFDA354C0D9
PyErr_SetString.PYTHON313 ref: 00007FFDA354C0F0

Strings

fileno, xrefs: 00007FFDA354C045
Expected a socket object or numeric socket handle, xrefs: 00007FFDA354C0E6

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$ClearDeallocObject_String$AttrCallCallable_CheckObject
String ID: Expected a socket object or numeric socket handle$fileno
API String ID: 994754094-511972153
Opcode ID: 7b3fa4a733cc4a24dd089f9560dc52097b810a406d96155e0d7f2db213339288
Instruction ID: 3aef656e5440fd0a66dc691bdd910e8580a2cb50701e52504b5700ce08353bf9
Opcode Fuzzy Hash: 7b3fa4a733cc4a24dd089f9560dc52097b810a406d96155e0d7f2db213339288
Instruction Fuzzy Hash: AD216231F0A64291EF468F6AE96423967A3AF85BD0F084031DA0F67756EF3EF5408708

Function 00007FFDA367628C Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PyEval_RestoreThread.PYTHON313 ref: 00007FFDA36762AB
PyObject_CallNoArgs.PYTHON313 ref: 00007FFDA36762C0

Part of subcall function 00007FFDA3676374: PyUnicode_AsUTF8String.PYTHON313(?,?,?,00007FFDA36762E0), ref: 00007FFDA36763A4
Part of subcall function 00007FFDA3676374: PyErr_Format.PYTHON313(?,?,?,00007FFDA36762E0), ref: 00007FFDA3676419
Part of subcall function 00007FFDA3676374: _Py_Dealloc.PYTHON313(?,?,?,00007FFDA36762E0), ref: 00007FFDA3676467

_Py_Dealloc.PYTHON313 ref: 00007FFDA36762F2
PyErr_Format.PYTHON313 ref: 00007FFDA3676311
PyEval_SaveThread.PYTHON313 ref: 00007FFDA3676317
_Py_Dealloc.PYTHON313 ref: 00007FFDA367634D
PyEval_SaveThread.PYTHON313 ref: 00007FFDA3676355
memcpy.VCRUNTIME140 ref: 00007FFDA3676369

Strings

password callback must return a string, xrefs: 00007FFDA36762CE
password cannot be longer than %d bytes, xrefs: 00007FFDA3676304

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: DeallocEval_Thread$Err_FormatSave$ArgsCallObject_RestoreStringUnicode_memcpy
String ID: password callback must return a string$password cannot be longer than %d bytes
API String ID: 1551476282-1265974473
Opcode ID: 451fe9cc037ae4ca0a52fdb4c774a51eb6ad11dc906b9a496bd4567f73c984d8
Instruction ID: ee0aca2e356161c4cda96db3039ae4103c7e15908fe6b8ec6a3921acb1828baf
Opcode Fuzzy Hash: 451fe9cc037ae4ca0a52fdb4c774a51eb6ad11dc906b9a496bd4567f73c984d8
Instruction Fuzzy Hash: 9C211A31F0AA42C6FA549B21E96417823B2FB44B95F8C6431DA1E63796CF3EE854C748

Function 00007FFDA3549AB0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 62COMMON

Download Yara Rule

APIs

PyImport_ImportModule.PYTHON313 ref: 00007FFDA3549AD1
PyObject_GetAttrString.PYTHON313 ref: 00007FFDA3549AED
_Py_Dealloc.PYTHON313 ref: 00007FFDA3549B04
PyTuple_New.PYTHON313 ref: 00007FFDA3549B11
PyObject_CallMethod.PYTHON313 ref: 00007FFDA3549B30
_Py_Dealloc.PYTHON313 ref: 00007FFDA3549B4B
_Py_Dealloc.PYTHON313 ref: 00007FFDA3549B66

Strings

TimeZoneInfo, xrefs: 00007FFDA3549AE3
utc, xrefs: 00007FFDA3549B29
win32timezone, xrefs: 00007FFDA3549ACA

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Dealloc$Object_$AttrCallImportImport_MethodModuleStringTuple_
String ID: TimeZoneInfo$utc$win32timezone
API String ID: 4031171350-3909237026
Opcode ID: 1639c5302ffb4b87e894b55701020ee97428cbbd91a9955a819a0ce4ffca2fd5
Instruction ID: c1616657abfa275ad066848c80321997dad617ccda443ed2ef7496b8f919eb20
Opcode Fuzzy Hash: 1639c5302ffb4b87e894b55701020ee97428cbbd91a9955a819a0ce4ffca2fd5
Instruction Fuzzy Hash: 4721F971F0F74281EB5B8B29E96627832A3AF48B94F488034C90E66752DF3EF554C708

Function 00007FFDA3678BB4 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 47COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON313 ref: 00007FFDA3678BEE
PyUnicode_AsUTF8AndSize.PYTHON313 ref: 00007FFDA3678BFE
PyErr_SetString.PYTHON313 ref: 00007FFDA3678C30

Strings

argument, xrefs: 00007FFDA3678BE0
No cipher can be selected., xrefs: 00007FFDA3678C50
str, xrefs: 00007FFDA3678BD9
set_ciphers, xrefs: 00007FFDA3678BE7
embedded null character, xrefs: 00007FFDA3678C26

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Arg_ArgumentErr_SizeStringUnicode_
String ID: No cipher can be selected.$argument$embedded null character$set_ciphers$str
API String ID: 4155279725-2765033273
Opcode ID: ea065838c93bf123b15737771585479b577fca96907ef9b0e34c49fa14334f0e
Instruction ID: 679247ed88aeef286529dfdd1bf9318e53ca87e9fef9af3e4913a57387fd34f6
Opcode Fuzzy Hash: ea065838c93bf123b15737771585479b577fca96907ef9b0e34c49fa14334f0e
Instruction Fuzzy Hash: D9118161B0BB4691FA108B15E4A40742362FF49BD0F8C6531CA1E277A2DF2EE889C308

Function 00007FFDA354CD50 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA354CDA6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354CDE4
PyErr_Format.PYTHON313 ref: 00007FFDA354CE06
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354CE17
_Py_Dealloc.PYTHON313 ref: 00007FFDA354CE3D

Strings

Unable to allocate %d bytes, xrefs: 00007FFDA354CDF9
Sequence of dwords cannot be None, xrefs: 00007FFDA354CD9C

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$DeallocFormatStringfreemalloc
String ID: Sequence of dwords cannot be None$Unable to allocate %d bytes
API String ID: 3558336878-651347692
Opcode ID: fcb0ab8fe880c01fc9c4e7ef5ed6a4521f4b799ff651dcb487074c39814b8e6a
Instruction ID: 8fdd7e1a410d023a071977f7fcbd2ad39fc81360052f8b9b0081d47e0f6b1213
Opcode Fuzzy Hash: fcb0ab8fe880c01fc9c4e7ef5ed6a4521f4b799ff651dcb487074c39814b8e6a
Instruction Fuzzy Hash: C8416C32B0AB4286EB16CF19E46413877A2FB89B94F044131DE4E17B65DF3EE495C708

Function 00007FFDA354C220 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 36memorythreadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FFDA354C22A
_Py_FatalErrorFunc.PYTHON313 ref: 00007FFDA354C250
LocalAlloc.KERNEL32 ref: 00007FFDA354C264
_Py_FatalErrorFunc.PYTHON313 ref: 00007FFDA354C280
TlsSetValue.KERNEL32 ref: 00007FFDA354C290
PyThreadState_New.PYTHON313 ref: 00007FFDA354C29D

Strings

Can not setup thread state, as have no interpreter state, xrefs: 00007FFDA354C242
PyWinThreadState_Ensure, xrefs: 00007FFDA354C249, 00007FFDA354C279
Out of memory allocating thread state., xrefs: 00007FFDA354C272

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: ErrorFatalFuncValue$AllocLocalState_Thread
String ID: Can not setup thread state, as have no interpreter state$Out of memory allocating thread state.$PyWinThreadState_Ensure
API String ID: 1925565299-3250566352
Opcode ID: 1cac388a50adace923c6ae1d37d3e8f41fd299e6d5f024e93c89565b812c4a96
Instruction ID: 2695a5a4f455438fea58059ca7fd9fc8965a7678cb1e392e1fd054b0bbc7a994
Opcode Fuzzy Hash: 1cac388a50adace923c6ae1d37d3e8f41fd299e6d5f024e93c89565b812c4a96
Instruction Fuzzy Hash: 09110C34F0AB4292EB068F18E8641753762BF44749F440535C54E62766EF7FF6958708

Function 00007FFDA3672828 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON313 ref: 00007FFDA367282E
PyUnicode_InternFromString.PYTHON313 ref: 00007FFDA367283E
PyUnicode_InternFromString.PYTHON313 ref: 00007FFDA3672854
PyUnicode_InternFromString.PYTHON313 ref: 00007FFDA367286D
PyUnicode_InternFromString.PYTHON313 ref: 00007FFDA3672886

Strings

reason, xrefs: 00007FFDA367284D
verify_message, xrefs: 00007FFDA3672866
library, xrefs: 00007FFDA3672834
verify_code, xrefs: 00007FFDA367287F

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: FromInternStringUnicode_$Module_State
String ID: library$reason$verify_code$verify_message
API String ID: 1970222510-435783180
Opcode ID: 4254d239cbb8c58497ed9e16c0f8c624f67e2f5b2410b21064c2b256a3b3d2a5
Instruction ID: 576b0755bb9753302d495a70cf50670914cdbc22ce8790780323428398cd3378
Opcode Fuzzy Hash: 4254d239cbb8c58497ed9e16c0f8c624f67e2f5b2410b21064c2b256a3b3d2a5
Instruction Fuzzy Hash: F701FB25B1BF0391FB509F24A86417422A2BF19710F8C2535C85E693E2EF3EA49DC318

Function 00007FFDA3672C10 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDA3672C38
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDA3672C8A
_RTC_Initialize.LIBCMT ref: 00007FFDA3672CB8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDA3672CDE
__scrt_release_startup_lock.LIBCMT ref: 00007FFDA3672D09

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 1a8d1f532519298a9da786a4129d135a06aa4afe88969801cf82f3079a6a7588
Instruction ID: 852b686c984c99d2a3847eb57171f4745222e3ff5d15410d73bdba6cbbc67eb2
Opcode Fuzzy Hash: 1a8d1f532519298a9da786a4129d135a06aa4afe88969801cf82f3079a6a7588
Instruction Fuzzy Hash: 5D811421F1E24386FA609B25A4712B92693AF45780FEC6034EA4C77B97DF3FE4458708

Function 00007FFDA3679030 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

PyCallable_Check.PYTHON313 ref: 00007FFDA3679088
PyErr_SetString.PYTHON313 ref: 00007FFDA36790A3
SSL_CTX_use_psk_identity_hint.LIBSSL-3 ref: 00007FFDA36790B9

Part of subcall function 00007FFDA3676750: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFDA3676768
Part of subcall function 00007FFDA3676750: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA3676791

_Py_Dealloc.PYTHON313 ref: 00007FFDA36790E8
SSL_CTX_set_psk_server_callback.LIBSSL-3 ref: 00007FFDA3679107

Strings

failed to set identity hint, xrefs: 00007FFDA36790CB
Cannot add PSK server callback to a PROTOCOL_TLS_CLIENT context, xrefs: 00007FFDA3679057
callback must be callable, xrefs: 00007FFDA3679099

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Callable_CheckDeallocErr_R_clear_errorR_peek_last_errorStringX_set_psk_server_callbackX_use_psk_identity_hint
String ID: Cannot add PSK server callback to a PROTOCOL_TLS_CLIENT context$callback must be callable$failed to set identity hint
API String ID: 2313049127-1396254157
Opcode ID: fb21281403a379b615c99ff083972a40e415b7fbdbf99e890c6c4d71a06daef1
Instruction ID: 818ab45f0259bb18c5f2a457f9a0ddd7aad3bb20f61a2ecee2ba55740d1ad0e1
Opcode Fuzzy Hash: fb21281403a379b615c99ff083972a40e415b7fbdbf99e890c6c4d71a06daef1
Instruction Fuzzy Hash: 1C314D31B1A602CAFA508F25D8A413863E2FB44F84B986435CA0DA7762CF7FE455C348

Function 00007FFDA354BDF0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

PyMem_Free.PYTHON313 ref: 00007FFDA354BE0E
PyBuffer_Release.PYTHON313 ref: 00007FFDA354BE32
PyErr_SetString.PYTHON313 ref: 00007FFDA354BE52
PyObject_GetBuffer.PYTHON313 ref: 00007FFDA354BE69
PyBuffer_Release.PYTHON313 ref: 00007FFDA354BE85
PyErr_Format.PYTHON313 ref: 00007FFDA354BE9F

Strings

Buffer length can be at most %d characters, xrefs: 00007FFDA354BE92
Buffer cannot be None, xrefs: 00007FFDA354BE48

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Buffer_Err_Release$BufferFormatFreeMem_Object_String
String ID: Buffer cannot be None$Buffer length can be at most %d characters
API String ID: 1675121998-686265896
Opcode ID: f330a7b27ad2e46ddd567d8aaf1c1d2df901e711178c835d73696d74e6b5d538
Instruction ID: 6aadaa33dac58e1ddef8e906a97f6361414772d04e45918d12d52eadc79fe5e3
Opcode Fuzzy Hash: f330a7b27ad2e46ddd567d8aaf1c1d2df901e711178c835d73696d74e6b5d538
Instruction Fuzzy Hash: A3312132B1AB4182EF5A8F19E4603382362FB84B84F445031DA5E67796CF3EE955C788

Function 00007FFDA36746D4 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 60COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA367470C
SSL_is_init_finished.LIBSSL-3 ref: 00007FFDA367474B
SSL_set_session.LIBSSL-3 ref: 00007FFDA3674776
SSL_SESSION_free.LIBSSL-3 ref: 00007FFDA3674781

Strings

Value is not a SSLSession., xrefs: 00007FFDA3674702
Session refers to a different SSLContext., xrefs: 00007FFDA3674728
Cannot set session after handshake., xrefs: 00007FFDA3674755
Cannot set session for server-side SSLSocket., xrefs: 00007FFDA367473E

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Err_L_is_init_finishedL_set_sessionN_freeString
String ID: Cannot set session after handshake.$Cannot set session for server-side SSLSocket.$Session refers to a different SSLContext.$Value is not a SSLSession.
API String ID: 2514955158-3160731334
Opcode ID: c68f23ef8fa8fe8aa0f0b8702e981877ea41e580611d10ca50f03757ef80513d
Instruction ID: 3d39c8947981f543ec81de2b2170517d155c7ce59a3ef585b25cc3e8d8356e2c
Opcode Fuzzy Hash: c68f23ef8fa8fe8aa0f0b8702e981877ea41e580611d10ca50f03757ef80513d
Instruction Fuzzy Hash: F9212165B0AA42C2FB14CB16D47D17823B2FF85B84B986531CA0D677A6DF3EE495C308

Function 00007FFDA367C9C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

PyArg_Parse.PYTHON313 ref: 00007FFDA367C9EF
PyLong_AsUnsignedLongLong.PYTHON313 ref: 00007FFDA367CA02
PyErr_Occurred.PYTHON313 ref: 00007FFDA367CA11
SSL_CTX_get_options.LIBSSL-3 ref: 00007FFDA367CA20
PyErr_WarnEx.PYTHON313 ref: 00007FFDA367CA58
SSL_CTX_clear_options.LIBSSL-3 ref: 00007FFDA367CA6E
SSL_CTX_set_options.LIBSSL-3 ref: 00007FFDA367CA80

Strings

ssl.OP_NO_SSL*/ssl.OP_NO_TLS* options are deprecated, xrefs: 00007FFDA367CA48

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Err_Long$Arg_Long_OccurredParseUnsignedWarnX_clear_optionsX_get_optionsX_set_options
String ID: ssl.OP_NO_SSL*/ssl.OP_NO_TLS* options are deprecated
API String ID: 2438043060-2795599882
Opcode ID: c0e64db1c963369a8a5ed26ffb050843c3af0e95e9869049d5e688494430fb2c
Instruction ID: f2da105384330d9327b3588f0c3a717ec7041475e45d60a2ed924b934cb8c794
Opcode Fuzzy Hash: c0e64db1c963369a8a5ed26ffb050843c3af0e95e9869049d5e688494430fb2c
Instruction Fuzzy Hash: 1621C825B0AA4282FB10CF21E96467923A2FF45FE1F5C6631DD2E67792DF6EE4448304

Function 00007FFDA367A790 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FFDA367A7E1
_PyArg_BadArgument.PYTHON313 ref: 00007FFDA367A81A
PyUnicode_AsUTF8AndSize.PYTHON313 ref: 00007FFDA367A827
PyErr_SetString.PYTHON313 ref: 00007FFDA367A859

Strings

argument 'store_name', xrefs: 00007FFDA367A813
str, xrefs: 00007FFDA367A805
enum_certificates, xrefs: 00007FFDA367A80C
embedded null character, xrefs: 00007FFDA367A84F

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Arg_$ArgumentErr_KeywordsSizeStringUnicode_Unpack
String ID: argument 'store_name'$embedded null character$enum_certificates$str
API String ID: 2966986319-2881692381
Opcode ID: 7f5ba209273cadbaaa0886b87aea74cb0cebff2d6555443c0b37e337afc2d137
Instruction ID: 179d243715fc5214dfb06ff9fc623fe63ff54843a34ee6313e9e7eaf73def46a
Opcode Fuzzy Hash: 7f5ba209273cadbaaa0886b87aea74cb0cebff2d6555443c0b37e337afc2d137
Instruction Fuzzy Hash: 83218E61B0BB0285FE10CB15E46427567A2FF48B90F9C2235D95D273A2EF3EE549C708

Function 00007FFDA367AB28 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON313 ref: 00007FFDA367AB79
_PyArg_BadArgument.PYTHON313 ref: 00007FFDA367ABB2
PyUnicode_AsUTF8AndSize.PYTHON313 ref: 00007FFDA367ABBF
PyErr_SetString.PYTHON313 ref: 00007FFDA367ABF1

Strings

argument 'store_name', xrefs: 00007FFDA367ABAB
str, xrefs: 00007FFDA367AB9D
embedded null character, xrefs: 00007FFDA367ABE7
enum_crls, xrefs: 00007FFDA367ABA4

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Arg_$ArgumentErr_KeywordsSizeStringUnicode_Unpack
String ID: argument 'store_name'$embedded null character$enum_crls$str
API String ID: 2966986319-2641223161
Opcode ID: 0186551bacce5e167eb27f67d7153db174b15f636566da8f41fccaa9d7114ce9
Instruction ID: f0be9cf21eb23657608f466669e39e05208e99eeabec0ab637bf4dbd47c76a67
Opcode Fuzzy Hash: 0186551bacce5e167eb27f67d7153db174b15f636566da8f41fccaa9d7114ce9
Instruction Fuzzy Hash: 0F219261B1BB0282FE10CB14E86427567A2EF49B90F8C6235DD1D173A2EF3EE448C708

Function 00007FFDA3549CA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON313 ref: 00007FFDA3549CC1
Py_BuildValue.PYTHON313 ref: 00007FFDA3549CDA
PyObject_GetAttrString.PYTHON313 ref: 00007FFDA3549CF5
PyObject_Call.PYTHON313 ref: 00007FFDA3549D0C
_Py_Dealloc.PYTHON313 ref: 00007FFDA3549D28
_Py_Dealloc.PYTHON313 ref: 00007FFDA3549D41

Strings

(s), xrefs: 00007FFDA3549CD3
strftime, xrefs: 00007FFDA3549CEB

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: DeallocObject_$AttrBuildCallSizeStringTuple_Value
String ID: (s)$strftime
API String ID: 4125559156-1254993691
Opcode ID: 705837201b98d33591091aae69fea6291c16dfc55d7ca099a681a7f42eb1c854
Instruction ID: 030da25346a461d9249fbdd02cb3784b8b79a110aac9508e29d866256f67fcb8
Opcode Fuzzy Hash: 705837201b98d33591091aae69fea6291c16dfc55d7ca099a681a7f42eb1c854
Instruction Fuzzy Hash: 76112E65F0BB4281EF5A8F1AE96523563A3AF45BC0F489034CA0E17B56EE3EF5408708

Function 00007FFDA36797B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SSL_is_init_finished.LIBSSL-3(?,?,00000000,00007FFDA3679796), ref: 00007FFDA36797D0
PyErr_SetString.PYTHON313(?,?,00000000,00007FFDA3679796), ref: 00007FFDA36797EB
SSL_get1_peer_certificate.LIBSSL-3(?,?,00000000,00007FFDA3679796), ref: 00007FFDA36797F9

Strings

handshake not done yet, xrefs: 00007FFDA36797E1

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Err_L_get1_peer_certificateL_is_init_finishedString
String ID: handshake not done yet
API String ID: 1333720006-2620869922
Opcode ID: f092b3b7c3ee2ed00ca93eb839ed0a4996e54995b990773d5699899330fd975d
Instruction ID: 635e4bb4c1d8b86b96756f8e43bdb01d0013c90673e5ca2f8b748f7f2cd14f12
Opcode Fuzzy Hash: f092b3b7c3ee2ed00ca93eb839ed0a4996e54995b990773d5699899330fd975d
Instruction Fuzzy Hash: 6F112421F0AA42C1FA10DF12E96403823E2BF88FC4B9C6535DD0E67766DF2EE4558344

Function 00007FFDA3548940 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3548961
IsValidSecurityDescriptor.ADVAPI32 ref: 00007FFDA354897A

Strings

GetSecurityDescriptorControl - invalid sd, xrefs: 00007FFDA3548986
:GetSecurityDescriptorControl, xrefs: 00007FFDA354894E
GetSecurityDescriptorControl, xrefs: 00007FFDA35489B1
(ii), xrefs: 00007FFDA35489C8

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_DescriptorParseSecurityTupleValid
String ID: (ii)$:GetSecurityDescriptorControl$GetSecurityDescriptorControl$GetSecurityDescriptorControl - invalid sd
API String ID: 1292091245-2499011972
Opcode ID: 0c79a85f94f1c090c5a74baff4f4abb4b723d10cf59a6917a5b5309dfcd3027e
Instruction ID: 048f22d485d95ce417ed09df27588ae1a04c22e15240a6cfcd8c93cf30ff8b57
Opcode Fuzzy Hash: 0c79a85f94f1c090c5a74baff4f4abb4b723d10cf59a6917a5b5309dfcd3027e
Instruction Fuzzy Hash: BE01C892F1B60283EF1A8B2AF8610B92363EF84745F485035D91F52756EF3EE595C708

Function 00007FFDA354ECA8 Relevance: 13.7, APIs: 9, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDA354ECD0
__scrt_initialize_crt.LIBCMT ref: 00007FFDA354ED15
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDA354ED22
_RTC_Initialize.LIBCMT ref: 00007FFDA354ED50
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDA354ED76
__scrt_release_startup_lock.LIBCMT ref: 00007FFDA354EDA1

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: deb1322ace880252273496c75106878e47c311885b03c3f26c29ac77a371df4f
Instruction ID: 12aa0bdc9d94617478b8d701bdd75ec4f8e5437c3b7eecc227c4b430669f9129
Opcode Fuzzy Hash: deb1322ace880252273496c75106878e47c311885b03c3f26c29ac77a371df4f
Instruction Fuzzy Hash: 2D81C021F0E30346FB5A9B6E94612792693AF45780F448039E90D67793EF3FE851870C

Function 00007FFDA3679D98 Relevance: 13.6, APIs: 9, Instructions: 78COMMON

Download Yara Rule

APIs

SSL_get_ciphers.LIBSSL-3 ref: 00007FFDA3679DBD
SSL_get_client_ciphers.LIBSSL-3 ref: 00007FFDA3679DD3
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFDA3679DE8
PyList_New.PYTHON313 ref: 00007FFDA3679DF1
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFDA3679E06
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFDA3679E18
OPENSSL_sk_find.LIBCRYPTO-3 ref: 00007FFDA3679E27
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFDA3679E51
_Py_Dealloc.PYTHON313 ref: 00007FFDA3679E75

Part of subcall function 00007FFDA367B710: PyTuple_New.PYTHON313 ref: 00007FFDA367B722
Part of subcall function 00007FFDA367B710: SSL_CIPHER_get_name.LIBSSL-3 ref: 00007FFDA367B737
Part of subcall function 00007FFDA367B710: SSL_CIPHER_get_version.LIBSSL-3 ref: 00007FFDA367B769
Part of subcall function 00007FFDA367B710: SSL_CIPHER_get_bits.LIBSSL-3 ref: 00007FFDA367B79D
Part of subcall function 00007FFDA367B710: PyLong_FromLong.PYTHON313 ref: 00007FFDA367B7A5

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: L_sk_num$DeallocFromL_get_ciphersL_get_client_ciphersL_sk_findL_sk_valueList_LongLong_R_get_bitsR_get_nameR_get_versionTuple_
String ID:
API String ID: 1361062010-0
Opcode ID: 4f2b3bef921491daf3ea2ab79f14d545e63694236941bf4e1b89b9a0533f4308
Instruction ID: c9bf50c017f4eded8fc802028fb3c0efb58604f3065c268b02e6aed6f6002161
Opcode Fuzzy Hash: 4f2b3bef921491daf3ea2ab79f14d545e63694236941bf4e1b89b9a0533f4308
Instruction Fuzzy Hash: 9C218221B1BB0285FA559F12A96453932D2AF44FD5F8C2434CD0E56396EF3EE4458348

Function 00007FFDA36779DC Relevance: 13.6, APIs: 9, Instructions: 70COMMON

Download Yara Rule

APIs

SSL_new.LIBSSL-3 ref: 00007FFDA36779FF
SSL_get_ciphers.LIBSSL-3 ref: 00007FFDA3677A2B
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFDA3677A37
PyList_New.PYTHON313 ref: 00007FFDA3677A40
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFDA3677A53
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFDA3677A65
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFDA3677A8C
SSL_free.LIBSSL-3 ref: 00007FFDA3677AB0

Part of subcall function 00007FFDA3676750: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FFDA3676768
Part of subcall function 00007FFDA3676750: ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDA3676791

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: L_sk_num$L_freeL_get_ciphersL_newL_sk_valueList_R_clear_errorR_peek_last_error
String ID:
API String ID: 722909353-0
Opcode ID: 8396214c4882a56f0fae0f7fc67bfd013babba7491e12d419a084fc45d29b7b4
Instruction ID: fd7e3f4c5ff8dbf2e1f96a303d7d4d5822372ae88ec7a0c39eb7193395ba5f81
Opcode Fuzzy Hash: 8396214c4882a56f0fae0f7fc67bfd013babba7491e12d419a084fc45d29b7b4
Instruction Fuzzy Hash: 2421B321F0BB4286FA04DF66A8340B96392BF84B85F8D2430DD4E63356EF7EE1458308

Function 00007FFDA35471F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 67stringCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA354721E
PyUnicode_AsUTF8.PYTHON313 ref: 00007FFDA354723C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA3547251
_Py_Dealloc.PYTHON313 ref: 00007FFDA354729C

Strings

can't delete SECURITY_ATTRIBUTES attributes, xrefs: 00007FFDA3547214
SECURITY_DESCRIPTOR, xrefs: 00007FFDA3547247
The object is not a PySECURITY_DESCRIPTOR object, xrefs: 00007FFDA354727B

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: DeallocErr_StringUnicode_strcmp
String ID: SECURITY_DESCRIPTOR$The object is not a PySECURITY_DESCRIPTOR object$can't delete SECURITY_ATTRIBUTES attributes
API String ID: 2499284733-1426751177
Opcode ID: 67049ca7dcf50a80a15f7371c299508b5eda7be6bbffd79b9bab495011e33978
Instruction ID: 380e9c030dfe4d12384ef3e198bc19cb7700a6838e6855135ba0c9be93f29733
Opcode Fuzzy Hash: 67049ca7dcf50a80a15f7371c299508b5eda7be6bbffd79b9bab495011e33978
Instruction Fuzzy Hash: 23213431F1EB5281EE5A8F6AE46013863A2FB44BC4F484131EA1E67B56DF3DF5518708

Function 00007FFDA3542310 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON313 ref: 00007FFDA3542358
PyArg_ParseTupleAndKeywords.PYTHON313 ref: 00007FFDA3542396
_Py_Dealloc.PYTHON313 ref: 00007FFDA35423AC
PyErr_SetString.PYTHON313 ref: 00007FFDA35423CC
_Py_Dealloc.PYTHON313 ref: 00007FFDA35423F2

Strings

EXPLICIT_ACCESS must be a dictionary containing {AccessPermissions:int,AccessMode:int,Inheritance:int,Trustee:<o PyTRUSTEE>}, xrefs: 00007FFDA35423C2
lllO, xrefs: 00007FFDA3542384

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Dealloc$Arg_Err_KeywordsParseStringTupleTuple_
String ID: EXPLICIT_ACCESS must be a dictionary containing {AccessPermissions:int,AccessMode:int,Inheritance:int,Trustee:<o PyTRUSTEE>}$lllO
API String ID: 959004690-1584370844
Opcode ID: 40621dbdd1e1618c9ed3fe52cc1117dbd46a93d7919a77fe4b0fca76490f5cd3
Instruction ID: 0b8e1d0606bd3b095161bf0ed94a49820e84f1e35815cc98ac3d740da29441f1
Opcode Fuzzy Hash: 40621dbdd1e1618c9ed3fe52cc1117dbd46a93d7919a77fe4b0fca76490f5cd3
Instruction Fuzzy Hash: 12314D72F0DB8682EB099F19F45026973A2FB84B84F044131EA8E13B56EF7DE594C748

Function 00007FFDA3545A60 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA3545AC8

Part of subcall function 00007FFDA354CEB0: PyNumber_Long.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEC5
Part of subcall function 00007FFDA354CEB0: PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CED3
Part of subcall function 00007FFDA354CEB0: PyLong_AsLongLong.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEE1
Part of subcall function 00007FFDA354CEB0: PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEF0
Part of subcall function 00007FFDA354CEB0: PyErr_Clear.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEFB
Part of subcall function 00007FFDA354CEB0: PyLong_AsUnsignedLongLong.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF04
Part of subcall function 00007FFDA354CEB0: PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF13
Part of subcall function 00007FFDA354CEB0: _Py_Dealloc.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF2C
Part of subcall function 00007FFDA354CEB0: PyErr_Format.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF4B

PyErr_SetString.PYTHON313 ref: 00007FFDA3545B09
RegCloseKey.ADVAPI32 ref: 00007FFDA3545B1C

Strings

RegCloseKey, xrefs: 00007FFDA3545B2D
PyHKEY, xrefs: 00007FFDA3545A88
The object is not a PyHANDLE object, xrefs: 00007FFDA3545AFF
HANDLE must be a PyHKEY, xrefs: 00007FFDA3545ABE

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$Long$Occurred$Long_String$ClearCloseDeallocFormatNumber_Unsigned
String ID: HANDLE must be a PyHKEY$PyHKEY$RegCloseKey$The object is not a PyHANDLE object
API String ID: 3516211060-2695813183
Opcode ID: 0c5216022337286ed9870b41cdd036d90f6bfea009756c59fba8a0f1fd48fc4d
Instruction ID: c675826a1da3c3a429bf72a4ef5add11d1862e12860c11dbcccd16f2e62cb8ca
Opcode Fuzzy Hash: 0c5216022337286ed9870b41cdd036d90f6bfea009756c59fba8a0f1fd48fc4d
Instruction Fuzzy Hash: 4921B521B1AA42C1EF468F2AE4B007963A3EB84BC4F441031DA0F57762DF2EE589C304

Function 00007FFDA3546460 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyLong_AsLongLong.PYTHON313 ref: 00007FFDA3546485
PyErr_Occurred.PYTHON313 ref: 00007FFDA3546494
PyErr_WarnEx.PYTHON313 ref: 00007FFDA35464E3
PyArg_ParseTuple.PYTHON313 ref: 00007FFDA35464FD
PyErr_SetString.PYTHON313 ref: 00007FFDA3546518

Strings

LARGE_INTEGER must be 'int', or '(int, int)', xrefs: 00007FFDA354650E
Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead, xrefs: 00007FFDA35464D1

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$Long$Arg_Long_OccurredParseStringTupleWarn
String ID: LARGE_INTEGER must be 'int', or '(int, int)'$Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead
API String ID: 3944559157-3919795897
Opcode ID: 28b8025bfafdb96d4bfd2a0ca2c1a4757072f5f8cd4f8e2994eeed24b2e5cec3
Instruction ID: c9048d96b6b6678156172ceabd71fed8b4a1da74b6502bb7fb209b481cbf500c
Opcode Fuzzy Hash: 28b8025bfafdb96d4bfd2a0ca2c1a4757072f5f8cd4f8e2994eeed24b2e5cec3
Instruction Fuzzy Hash: FA21CE21B0AB4281EB518F1EF4902296762FB88BD8F444131EB9E53769DE3EE585C704

Function 00007FFDA354D400 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

PyBuffer_Release.PYTHON313 ref: 00007FFDA354D43A
PyErr_SetString.PYTHON313 ref: 00007FFDA354D471
PyObject_GetBuffer.PYTHON313 ref: 00007FFDA354D487
PyBuffer_Release.PYTHON313 ref: 00007FFDA354D4A2
PyErr_Format.PYTHON313 ref: 00007FFDA354D4BC

Strings

Buffer length can be at most %d characters, xrefs: 00007FFDA354D4AF
Buffer cannot be None, xrefs: 00007FFDA354D467

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Buffer_Err_Release$BufferFormatObject_String
String ID: Buffer cannot be None$Buffer length can be at most %d characters
API String ID: 1670810688-686265896
Opcode ID: b8068afb17dceacaa5a51a8d99800dcb7b56c81bac3d0113414031d6818f4ca7
Instruction ID: 2ba9118c594e0c4ea01afc600246028a9523fbe7dae638aab9487081e629bbf6
Opcode Fuzzy Hash: b8068afb17dceacaa5a51a8d99800dcb7b56c81bac3d0113414031d6818f4ca7
Instruction Fuzzy Hash: 08212831B0BB4680EB568F19E460238A3A3EB44B94F184431D94E57B9ADE7EF5808788

Function 00007FFDA3546560 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON313 ref: 00007FFDA354657D
PyErr_Occurred.PYTHON313 ref: 00007FFDA354658C
PyArg_ParseTuple.PYTHON313 ref: 00007FFDA35465C9
PyErr_SetString.PYTHON313 ref: 00007FFDA35465E4
PyErr_WarnEx.PYTHON313 ref: 00007FFDA3546610

Strings

ULARGE_INTEGER must be 'int', or '(int, int)', xrefs: 00007FFDA35465DA
Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead, xrefs: 00007FFDA35465FE

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$Long$Arg_Long_OccurredParseStringTupleUnsignedWarn
String ID: Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead$ULARGE_INTEGER must be 'int', or '(int, int)'
API String ID: 507489655-1767028231
Opcode ID: 01d08b6a7bdc53fd350f74aed6df4b248a7441d7d16c80b61a1c5fffd659387c
Instruction ID: 8836f4ffba7cf3d98c628315b0cbe7a32fa747212b290200868820ba2ce60865
Opcode Fuzzy Hash: 01d08b6a7bdc53fd350f74aed6df4b248a7441d7d16c80b61a1c5fffd659387c
Instruction Fuzzy Hash: 3721C221B09B4281EF418F5EF49026963A2FF887D4F845131EA6E4779ADE3EE594C704

Function 00007FFDA367702C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON313 ref: 00007FFDA3677052
PyModule_GetState.PYTHON313 ref: 00007FFDA367705B
_PyArg_NoKeywords.PYTHON313 ref: 00007FFDA3677088
_PyArg_CheckPositional.PYTHON313 ref: 00007FFDA36770AB
PyLong_AsInt.PYTHON313 ref: 00007FFDA36770B9
PyErr_Occurred.PYTHON313 ref: 00007FFDA36770C6

Strings

_SSLContext, xrefs: 00007FFDA3677081, 00007FFDA36770A4

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Arg_$CheckErr_KeywordsLong_ModuleModule_OccurredPositionalStateType_
String ID: _SSLContext
API String ID: 3264916389-1468230856
Opcode ID: 987a8b73833f867488729d6e38bb227978c0df7791cda1cd7699adc4e07a767e
Instruction ID: 959c1996afdf0540d386dc56f93d236cc19bdf00e577eee62a8826a7f9749f18
Opcode Fuzzy Hash: 987a8b73833f867488729d6e38bb227978c0df7791cda1cd7699adc4e07a767e
Instruction Fuzzy Hash: EE21A561B0AB4282FA508B22E8641B563A2FF48FD0F9C6431DD5D67756DF7FE4858308

Function 00007FFDA367B1CC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

BIO_s_mem.LIBCRYPTO-3 ref: 00007FFDA367B1E6
BIO_new.LIBCRYPTO-3 ref: 00007FFDA367B1EF
PyErr_SetString.PYTHON313 ref: 00007FFDA367B210
X509_NAME_print_ex.LIBCRYPTO-3 ref: 00007FFDA367B229
BIO_free.LIBCRYPTO-3 ref: 00007FFDA367B25F

Strings

failed to allocate BIO, xrefs: 00007FFDA367B206
strict, xrefs: 00007FFDA367B24A

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: E_print_exErr_O_freeO_newO_s_memStringX509_
String ID: failed to allocate BIO$strict
API String ID: 220268057-2811890329
Opcode ID: 45d9a39df6a1ebb40e44180eac2f81db80ffa4c90534aa3307a75c1a238b5011
Instruction ID: 59a66a112cad71eff5a3351f9014b1684ea1639e69e7790019c8d6ffb9d2a2f2
Opcode Fuzzy Hash: 45d9a39df6a1ebb40e44180eac2f81db80ffa4c90534aa3307a75c1a238b5011
Instruction Fuzzy Hash: 4F115421B0AA4282F6509B16B8241396362BF89FD4F8C6031DD5D67B26DF3EE0458748

Function 00007FFDA3544960 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA3544982
PyBytes_AsStringAndSize.PYTHON313 ref: 00007FFDA35449A0
PyErr_Format.PYTHON313 ref: 00007FFDA35449CC

Strings

Length of DriverData cannot be longer that DriverExtra (%d bytes), xrefs: 00007FFDA35449C2
Attributes of PyDEVMODEW can't be deleted, xrefs: 00007FFDA3544978

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_String$Bytes_FormatSize
String ID: Attributes of PyDEVMODEW can't be deleted$Length of DriverData cannot be longer that DriverExtra (%d bytes)
API String ID: 1818008259-1897733207
Opcode ID: a5819ef29f43b57301ff4610e968360216c56eb932ab9b6083dcd6627cabfeef
Instruction ID: 63af16d7c2270c0bf8773e8785f4925f604ca33ae909c09fddabfe92f158f7e0
Opcode Fuzzy Hash: a5819ef29f43b57301ff4610e968360216c56eb932ab9b6083dcd6627cabfeef
Instruction Fuzzy Hash: 8911C6A1F0AB0281DF058B2DD8610792763EF84BE0B041231D92F577B5EF2EE495C704

Function 00007FFDA36722C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

OBJ_obj2nid.LIBCRYPTO-3(?,?,?,?,?,00007FFDA36722A6), ref: 00007FFDA36722EA
OBJ_nid2sn.LIBCRYPTO-3(?,?,?,?,?,00007FFDA36722A6), ref: 00007FFDA36722FC
OBJ_nid2ln.LIBCRYPTO-3(?,?,?,?,?,00007FFDA36722A6), ref: 00007FFDA3672307

Part of subcall function 00007FFDA3672358: OBJ_obj2txt.LIBCRYPTO-3 ref: 00007FFDA367239D
Part of subcall function 00007FFDA3672358: PyUnicode_FromStringAndSize.PYTHON313 ref: 00007FFDA36723C3

Py_BuildValue.PYTHON313(?,?,?,?,?,00007FFDA36722A6), ref: 00007FFDA3672335
PyErr_Format.PYTHON313(?,?,?,?,?,00007FFDA36722A6), ref: 00007FFDA3673B9D

Strings

Unknown object, xrefs: 00007FFDA3673B93
issN, xrefs: 00007FFDA367232C

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: BuildErr_FormatFromJ_nid2lnJ_nid2snJ_obj2nidJ_obj2txtSizeStringUnicode_Value
String ID: Unknown object$issN
API String ID: 2277031989-847857892
Opcode ID: 42d544a5f2839ee0200b4fe2f75c4c601cb5a853b30f8e01e6d47e3f2ee2f612
Instruction ID: 672c98d30da9939fed0c95ab5d85c1c3dad84035208250b94a76125f2a1e7a1d
Opcode Fuzzy Hash: 42d544a5f2839ee0200b4fe2f75c4c601cb5a853b30f8e01e6d47e3f2ee2f612
Instruction Fuzzy Hash: 66118E25B09B4281FA008B22F82406977A6FB88FD4B9C1435DE4DA7766CF3EE1058348

Function 00007FFDA367B044 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313(?,?,00000000,00007FFDA367B02D), ref: 00007FFDA367B06D
OBJ_nid2obj.LIBCRYPTO-3(?,?,00000000,00007FFDA367B02D), ref: 00007FFDA367B079
PyErr_Format.PYTHON313(?,?,00000000,00007FFDA367B02D), ref: 00007FFDA367B09B
PyModule_GetState.PYTHON313(?,?,00000000,00007FFDA367B02D), ref: 00007FFDA367B0A6

Part of subcall function 00007FFDA36722C8: OBJ_obj2nid.LIBCRYPTO-3(?,?,?,?,?,00007FFDA36722A6), ref: 00007FFDA36722EA
Part of subcall function 00007FFDA36722C8: OBJ_nid2sn.LIBCRYPTO-3(?,?,?,?,?,00007FFDA36722A6), ref: 00007FFDA36722FC
Part of subcall function 00007FFDA36722C8: OBJ_nid2ln.LIBCRYPTO-3(?,?,?,?,?,00007FFDA36722A6), ref: 00007FFDA3672307
Part of subcall function 00007FFDA36722C8: Py_BuildValue.PYTHON313(?,?,?,?,?,00007FFDA36722A6), ref: 00007FFDA3672335

ASN1_OBJECT_free.LIBCRYPTO-3(?,?,00000000,00007FFDA367B02D), ref: 00007FFDA367B0BD

Strings

NID must be positive., xrefs: 00007FFDA367B063
unknown NID %i, xrefs: 00007FFDA367B08E

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Err_$BuildFormatJ_nid2lnJ_nid2objJ_nid2snJ_obj2nidModule_StateStringT_freeValue
String ID: NID must be positive.$unknown NID %i
API String ID: 1079357630-2656559464
Opcode ID: d8c9c2db7b88e3514f31857551da2f2394f72a9ee13964bb6130a15aada5b37e
Instruction ID: 88bec86e4c6aab6c128965337844fabcc4532e9a34e7ae6672b60d3b75595709
Opcode Fuzzy Hash: d8c9c2db7b88e3514f31857551da2f2394f72a9ee13964bb6130a15aada5b37e
Instruction Fuzzy Hash: 7B014414B0EA4282FE04CB16E5740386362BF8CFD4B886434D91E67B66EF6EE4458308

Function 00007FFDA3676AC8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

BIO_s_mem.LIBCRYPTO-3(?,?,00000000,00007FFDA3676AA0), ref: 00007FFDA3676AD5
BIO_new.LIBCRYPTO-3(?,?,00000000,00007FFDA3676AA0), ref: 00007FFDA3676ADE
PyErr_SetString.PYTHON313(?,?,00000000,00007FFDA3676AA0), ref: 00007FFDA3676AFD
BIO_set_flags.LIBCRYPTO-3(?,?,00000000,00007FFDA3676AA0), ref: 00007FFDA3676B0F
BIO_ctrl.LIBCRYPTO-3(?,?,00000000,00007FFDA3676AA0), ref: 00007FFDA3676B24
BIO_free.LIBCRYPTO-3(?,?,00000000,00007FFDA3676AA0), ref: 00007FFDA3676B3D

Strings

failed to allocate BIO, xrefs: 00007FFDA3676AF3

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Err_O_ctrlO_freeO_newO_s_memO_set_flagsString
String ID: failed to allocate BIO
API String ID: 68942223-3472608418
Opcode ID: c6033ec318cdf6af549f8bf24f9750b080f66e7010b115b7e21bf31243622685
Instruction ID: 504e36a4e6f19d2454f2b51fa5d6d334f9de23ae6198e6c87649ea4d712b9979
Opcode Fuzzy Hash: c6033ec318cdf6af549f8bf24f9750b080f66e7010b115b7e21bf31243622685
Instruction Fuzzy Hash: 2E017921F1AA0382FB548B11F9682356362EF89F55F9C7030C91E1B756DF3ED4588304

Function 00007FFDA3549240 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA354925B
GetSidSubAuthorityCount.ADVAPI32 ref: 00007FFDA354926C
GetSidSubAuthority.ADVAPI32 ref: 00007FFDA3549282
PyLong_FromLong.PYTHON313 ref: 00007FFDA354928A
PyErr_SetString.PYTHON313 ref: 00007FFDA35492A7

Strings

i:GetSubAuthority, xrefs: 00007FFDA3549251
The index is out of range, xrefs: 00007FFDA354929D

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Authority$Arg_CountErr_FromLongLong_ParseStringTuple
String ID: The index is out of range$i:GetSubAuthority
API String ID: 2376698166-2602025648
Opcode ID: 9792cac582ac62394290b1a74a7f90c0f1413b6a5918cc6ae41e1e619801df51
Instruction ID: 35aae5c32f6f473e0704f720b6dff310329ea35a8ef05e7628182818ce1fa34e
Opcode Fuzzy Hash: 9792cac582ac62394290b1a74a7f90c0f1413b6a5918cc6ae41e1e619801df51
Instruction Fuzzy Hash: CEF03161F0A74383EF068B6AE86507837A2AF89B81B484031C91F17712DE3EF598C708

Function 00007FFDA367B7DC Relevance: 12.1, APIs: 8, Instructions: 66threadCOMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FFDA367B807
_Py_Dealloc.PYTHON313 ref: 00007FFDA367B824
_Py_Dealloc.PYTHON313 ref: 00007FFDA367B841
_Py_Dealloc.PYTHON313 ref: 00007FFDA367B85E
_Py_Dealloc.PYTHON313 ref: 00007FFDA367B87B
PyEval_SaveThread.PYTHON313 ref: 00007FFDA367B887
BIO_free_all.LIBCRYPTO-3 ref: 00007FFDA367B894
PyEval_RestoreThread.PYTHON313 ref: 00007FFDA367B89D

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Dealloc$Eval_Thread$O_free_allRestoreSave
String ID:
API String ID: 86175192-0
Opcode ID: a526db3d70cb72d2e47159ba5ba1d0892e5bea49cd84f23f6d0ad84e29bbc077
Instruction ID: a178d1a55bb521cdb17b3cd56e13a79c62fcd818b6a93a9a30b5101a299e3c0d
Opcode Fuzzy Hash: a526db3d70cb72d2e47159ba5ba1d0892e5bea49cd84f23f6d0ad84e29bbc077
Instruction Fuzzy Hash: 21310636F0BA12C3FA199F65A56003873A6FF48F54B9C6430DA1963B42CF3EE4668344

Function 00007FFDA367B710 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON313 ref: 00007FFDA367B722
SSL_CIPHER_get_name.LIBSSL-3 ref: 00007FFDA367B737
PyUnicode_FromString.PYTHON313 ref: 00007FFDA367B757
SSL_CIPHER_get_version.LIBSSL-3 ref: 00007FFDA367B769
PyUnicode_FromString.PYTHON313 ref: 00007FFDA367B789
SSL_CIPHER_get_bits.LIBSSL-3 ref: 00007FFDA367B79D
PyLong_FromLong.PYTHON313 ref: 00007FFDA367B7A5
_Py_Dealloc.PYTHON313 ref: 00007FFDA367B7C7

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: From$StringUnicode_$DeallocLongLong_R_get_bitsR_get_nameR_get_versionTuple_
String ID:
API String ID: 4201023408-0
Opcode ID: 92463eef1294cda53afe581ae51a2d528783200c8e0cbf85e32760b8a973adc4
Instruction ID: 52e776d43d825b8558445ae94db0ab7751d43b8921b13881e82c18a942781ae0
Opcode Fuzzy Hash: 92463eef1294cda53afe581ae51a2d528783200c8e0cbf85e32760b8a973adc4
Instruction Fuzzy Hash: B821DE35B0B702C6FE598F55A5B827823E6AF48F44F9C6438C90E57392EF3EA4548708

Function 00007FFDA35474A0 Relevance: 12.1, APIs: 8, Instructions: 52COMMON

Download Yara Rule

APIs

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FFDA35474B8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35474D3
GetSecurityDescriptorSacl.ADVAPI32 ref: 00007FFDA35474EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3547506
GetSecurityDescriptorOwner.ADVAPI32 ref: 00007FFDA3547519
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354752D
GetSecurityDescriptorGroup.ADVAPI32 ref: 00007FFDA3547540
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3547554

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: DescriptorSecurityfree$DaclGroupOwnerSacl
String ID:
API String ID: 1788430091-0
Opcode ID: f80fdbaf805613b61b14d3bdd1e52ccbc5edc22b729c516d134f0c2fd5eeb702
Instruction ID: e23b8f043fe65a163ad0486addd4f4a17bfc546837de98b9ba3b01a51018d516
Opcode Fuzzy Hash: f80fdbaf805613b61b14d3bdd1e52ccbc5edc22b729c516d134f0c2fd5eeb702
Instruction Fuzzy Hash: EB213621B0B64282EF569F59E4702B56B72FF85780F440032EA5F56A65DE3EE548C704

Function 00007FFDA3672358 Relevance: 10.6, APIs: 7, Instructions: 91COMMON

Download Yara Rule

APIs

OBJ_obj2txt.LIBCRYPTO-3 ref: 00007FFDA367239D
PyUnicode_FromStringAndSize.PYTHON313 ref: 00007FFDA36723C3
OBJ_obj2txt.LIBCRYPTO-3 ref: 00007FFDA3673BD8
PyMem_Malloc.PYTHON313 ref: 00007FFDA3673BE5
OBJ_obj2txt.LIBCRYPTO-3 ref: 00007FFDA3673BFF

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: J_obj2txt$FromMallocMem_SizeStringUnicode_
String ID:
API String ID: 2822617359-0
Opcode ID: 4b66cf8f34b4ec287d5df60869aa4060487ddbc370fdbcf9b23daf6b9612fe67
Instruction ID: 13f49d8fa6873e8558fe1d79850305beb5e44b51d493487b9c599a443cdff992
Opcode Fuzzy Hash: 4b66cf8f34b4ec287d5df60869aa4060487ddbc370fdbcf9b23daf6b9612fe67
Instruction Fuzzy Hash: 2D31C831B1A65285F7608B22A8647B92392BF48FD4F9C7430DD0E67B56DF3EE0458708

Function 00007FFDA3546AE0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

PyUnicode_AsUTF8.PYTHON313 ref: 00007FFDA3546AF8

Strings

InternalHigh, xrefs: 00007FFDA3546BA7
Internal, xrefs: 00007FFDA3546B7A
hEvent, xrefs: 00007FFDA3546B18

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Unicode_
String ID: Internal$InternalHigh$hEvent
API String ID: 2646675794-1769053571
Opcode ID: 3230954fda80a3a15b7262756ef6922f42f6b866fcf77cc308d0e9cd2de208ae
Instruction ID: 329576d33e9d388387a1dcae4f249ba759a3d25600d8ddd0e74018a7837075e8
Opcode Fuzzy Hash: 3230954fda80a3a15b7262756ef6922f42f6b866fcf77cc308d0e9cd2de208ae
Instruction Fuzzy Hash: F1318426B1AB8181DF568B1AF5601396762EF88BC4B081031EF4F2775ADE2DE491C708

Function 00007FFDA3549E90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON313(?,?,?,00007FFDA3549D82), ref: 00007FFDA3549EB4
PyErr_Format.PYTHON313(?,?,?,00007FFDA3549D82), ref: 00007FFDA3549ED7
PyObject_CallMethod.PYTHON313(?,?,?,00007FFDA3549D82), ref: 00007FFDA3549F03
_Py_Dealloc.PYTHON313(?,?,?,00007FFDA3549D82), ref: 00007FFDA3549F86

Strings

must be a pywintypes time object (got %s), xrefs: 00007FFDA3549EC2
astimezone, xrefs: 00007FFDA3549EF9

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: CallDeallocErr_FormatMethodObject_SubtypeType_
String ID: astimezone$must be a pywintypes time object (got %s)
API String ID: 244768906-1654730096
Opcode ID: 4ebedb747ce80201b9841f6db2a3ad0b1a2b2efc78f376f388bf9c6af551531f
Instruction ID: 63d0f3e64ddf45798d050ea2a18c68b8bac5aaa243cfbfff0b7a0112dcbf16a5
Opcode Fuzzy Hash: 4ebedb747ce80201b9841f6db2a3ad0b1a2b2efc78f376f388bf9c6af551531f
Instruction Fuzzy Hash: 2631E566B093C186DB4A8B2AD1711783BA2FF487C1B189037DB6E93752EF2DE154C714

Function 00007FFDA35487A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA35487B6
IsValidSecurityDescriptor.ADVAPI32 ref: 00007FFDA35487CF

Strings

:GetSecurityDescriptorDacl, xrefs: 00007FFDA35487AF
SetSecurityDescriptorGroup - invalid sd, xrefs: 00007FFDA35487DB
GetSecurityDescriptorDacl, xrefs: 00007FFDA354880B

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_DescriptorParseSecurityTupleValid
String ID: :GetSecurityDescriptorDacl$GetSecurityDescriptorDacl$SetSecurityDescriptorGroup - invalid sd
API String ID: 1292091245-161903415
Opcode ID: a70b8841fd3bb74fb48fc43b83994f4796f0aa5c67d2f1f93a678df09f3010b5
Instruction ID: 0b4611cde2df65a1e61487c140b4870d22e7c2d42b084cf3767a9e2c60af644a
Opcode Fuzzy Hash: a70b8841fd3bb74fb48fc43b83994f4796f0aa5c67d2f1f93a678df09f3010b5
Instruction Fuzzy Hash: DB11A8A6F0A60282FF0A8F1DF8202756393AF84B54F484431D91E53366EE3EE595C708

Function 00007FFDA3548870 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3548886
IsValidSecurityDescriptor.ADVAPI32 ref: 00007FFDA354889F

Strings

:GetSecurityDescriptorSacl, xrefs: 00007FFDA354887F
GetSecurityDescriptorSacl - invalid sd, xrefs: 00007FFDA35488AB
GetSecurityDescriptorSacl, xrefs: 00007FFDA35488DB

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_DescriptorParseSecurityTupleValid
String ID: :GetSecurityDescriptorSacl$GetSecurityDescriptorSacl$GetSecurityDescriptorSacl - invalid sd
API String ID: 1292091245-3167575759
Opcode ID: 51e9e47e3c590d4bcffd20fb1b34e3be24bc56202da4389d4add24541a4b39de
Instruction ID: 35a504be5f70350c0eb91823df512473284f742ee1212dfd6f22d634569e76fe
Opcode Fuzzy Hash: 51e9e47e3c590d4bcffd20fb1b34e3be24bc56202da4389d4add24541a4b39de
Instruction Fuzzy Hash: D611A5A5F1A64282FF0A8B1DF8202B563A3AF84794F484431D91E533A6DF3EE595C708

Function 00007FFDA35486E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA35486F6
IsValidSecurityDescriptor.ADVAPI32 ref: 00007FFDA354870F

Strings

:GetSecurityDescriptorGroup, xrefs: 00007FFDA35486EF
GetSecurityDescriptorGroup, xrefs: 00007FFDA3548746
GetSecurityDescriptorGroup - invalid sd, xrefs: 00007FFDA354871B

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_DescriptorParseSecurityTupleValid
String ID: :GetSecurityDescriptorGroup$GetSecurityDescriptorGroup$GetSecurityDescriptorGroup - invalid sd
API String ID: 1292091245-1740808346
Opcode ID: de9d71227a1b018458c6f32488d96044086d18eae158601c7319b79526419fff
Instruction ID: c9c5b8f7bb7bb8b09130fa89e5a719cff8b4ebf2d98e510e4afb48b4716962ef
Opcode Fuzzy Hash: de9d71227a1b018458c6f32488d96044086d18eae158601c7319b79526419fff
Instruction Fuzzy Hash: C71184A1F0A60282FF0E8B1EE8712752293AF84784F485031CA1E53357EE2EE5948708

Function 00007FFDA35498A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA35496D0: IsValidSid.ADVAPI32 ref: 00007FFDA35496E6

GetLastError.KERNEL32 ref: 00007FFDA35498C1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35498F0

Strings

PySID:, xrefs: 00007FFDA354990F
PySID: Invalid SID, xrefs: 00007FFDA35498CC

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: ErrorLastValidmalloc
String ID: PySID:$PySID: Invalid SID
API String ID: 814871005-2976353951
Opcode ID: bca7d20094dae963d8d92a0c666da5fa3ed3a1cb4ec8201cbe5f052b776f9036
Instruction ID: c89d8ebd247ed3eaa3cf26174a639e2cbc469a3332e7fe7c782b62b469cb356d
Opcode Fuzzy Hash: bca7d20094dae963d8d92a0c666da5fa3ed3a1cb4ec8201cbe5f052b776f9036
Instruction Fuzzy Hash: 9C21D161B1A78582EB4A8F19E4611B97363FB44BE0F44A131DE2E13792DF3CE194C708

Function 00007FFDA35442F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA354431E
GetAuditedPermissionsFromAclW.ADVAPI32 ref: 00007FFDA354434E
Py_BuildValue.PYTHON313 ref: 00007FFDA3544378
PyMem_Free.PYTHON313 ref: 00007FFDA3544392

Part of subcall function 00007FFDA354C400: GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C41B
Part of subcall function 00007FFDA354C400: FormatMessageW.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C48A
Part of subcall function 00007FFDA354C400: PyUnicode_DecodeMBCS.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C568
Part of subcall function 00007FFDA354C400: Py_BuildValue.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C57D
Part of subcall function 00007FFDA354C400: LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C595
Part of subcall function 00007FFDA354C400: PyErr_SetObject.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C5AA

Strings

O:GetAuditedPermissionsFromAcl, xrefs: 00007FFDA3544304
GetAuditedPermissionsFromAcl, xrefs: 00007FFDA354435A

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: BuildFreeValue$Arg_AuditedDecodeErr_ErrorFormatFromLastLocalMem_MessageObjectParsePermissionsTupleUnicode_
String ID: GetAuditedPermissionsFromAcl$O:GetAuditedPermissionsFromAcl
API String ID: 779572743-1982696749
Opcode ID: 6b9190123efeffe16bc3b1fe5c1430e533b7fa5cc7966d83ebfbad101224fffd
Instruction ID: 448da16f424c8ab501be0500fbfe1491423a60e75ee791e946066e402db9e45a
Opcode Fuzzy Hash: 6b9190123efeffe16bc3b1fe5c1430e533b7fa5cc7966d83ebfbad101224fffd
Instruction Fuzzy Hash: EF119272B0974292DB058F5AF45006EA7A2FB84B94F840036EA4F53B1AEF7DE584CB44

Function 00007FFDA367CBCC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

PyArg_Parse.PYTHON313 ref: 00007FFDA367CBF0
SSL_CTX_get0_param.LIBSSL-3 ref: 00007FFDA367CC03
X509_VERIFY_PARAM_get_flags.LIBCRYPTO-3 ref: 00007FFDA367CC0F
X509_VERIFY_PARAM_clear_flags.LIBCRYPTO-3 ref: 00007FFDA367CC2A
X509_VERIFY_PARAM_set_flags.LIBCRYPTO-3 ref: 00007FFDA367CC55

Strings

}, xrefs: 00007FFDA367CC5F

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: X509_$Arg_M_clear_flagsM_get_flagsM_set_flagsParseX_get0_param
String ID: }
API String ID: 1566575135-2784586233
Opcode ID: 34a11b25d548e90867ede705f9767b417e82e9383094fa6f29e7fc36470c5788
Instruction ID: 26472e42d51279fb9971d6dec19aa2c5bd95a3514d177508b56eb41a975d6da0
Opcode Fuzzy Hash: 34a11b25d548e90867ede705f9767b417e82e9383094fa6f29e7fc36470c5788
Instruction Fuzzy Hash: 2711B625B0DA4282F7108F66E46413973A2FF85F94F886131DA0D67756EF3EE0458B08

Function 00007FFDA3541240 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA3541288
PyObject_GetBuffer.PYTHON313 ref: 00007FFDA35412A6
PyBuffer_Release.PYTHON313 ref: 00007FFDA35412C6
PyErr_Format.PYTHON313 ref: 00007FFDA35412E0

Strings

Buffer length can be at most %d characters, xrefs: 00007FFDA35412D3
Buffer cannot be None, xrefs: 00007FFDA354127E

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$BufferBuffer_FormatObject_ReleaseString
String ID: Buffer cannot be None$Buffer length can be at most %d characters
API String ID: 3539591379-686265896
Opcode ID: 0da5e900bf8a33f3c475dd51dd89b2333c16a9d0b82ae7c2ec69a96980702169
Instruction ID: 540e1b7efd6584e7556f7d1c80fc820ff3079d2c06d63ca7276614cf4fc89b7c
Opcode Fuzzy Hash: 0da5e900bf8a33f3c475dd51dd89b2333c16a9d0b82ae7c2ec69a96980702169
Instruction Fuzzy Hash: 2A114261F5BB0281DE198F5AE4501342393FB89B94F485030CD1E97755DF3EE595C748

Function 00007FFDA3544230 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA354425A
GetEffectiveRightsFromAclW.ADVAPI32 ref: 00007FFDA3544285
Py_BuildValue.PYTHON313 ref: 00007FFDA35442AA
PyMem_Free.PYTHON313 ref: 00007FFDA35442C4

Part of subcall function 00007FFDA354C400: GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C41B
Part of subcall function 00007FFDA354C400: FormatMessageW.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C48A
Part of subcall function 00007FFDA354C400: PyUnicode_DecodeMBCS.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C568
Part of subcall function 00007FFDA354C400: Py_BuildValue.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C57D
Part of subcall function 00007FFDA354C400: LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C595
Part of subcall function 00007FFDA354C400: PyErr_SetObject.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C5AA

Strings

GetEffectiveRightsFromAcl, xrefs: 00007FFDA3544291
O:GetEffectiveRightsFromAcl, xrefs: 00007FFDA3544245

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: BuildFreeValue$Arg_DecodeEffectiveErr_ErrorFormatFromLastLocalMem_MessageObjectParseRightsTupleUnicode_
String ID: GetEffectiveRightsFromAcl$O:GetEffectiveRightsFromAcl
API String ID: 2073598658-568366055
Opcode ID: 247de53edbba7a4271bbf513ae11bb24d89cab06e9711837b0c51d0caff24205
Instruction ID: aceece3ce1cd6fb848a833b4e25ca5dec350a90b21accd4912d7eb3edb97292e
Opcode Fuzzy Hash: 247de53edbba7a4271bbf513ae11bb24d89cab06e9711837b0c51d0caff24205
Instruction Fuzzy Hash: CF119D62B0EB4692EA028F5AF4600BAA3A2FF84784F444131DA4F57B5ADF7DE505CB04

Function 00007FFDA3543C60 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3543C7B
GetAce.ADVAPI32 ref: 00007FFDA3543C9A

Strings

GetAce, xrefs: 00007FFDA3543CA6
Ace type %d is not supported yet, xrefs: 00007FFDA3543E62
l:GetAce, xrefs: 00007FFDA3543C71

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: Ace type %d is not supported yet$GetAce$l:GetAce
API String ID: 3371842430-2172617993
Opcode ID: c9224e87bc8317b6439b7db474916c839e8cf08f52e6895d905d1aca719b8969
Instruction ID: 091d6a83cdb907a5f114ac32c731f2d69c8c851d7b7350eb172b710a96c273eb
Opcode Fuzzy Hash: c9224e87bc8317b6439b7db474916c839e8cf08f52e6895d905d1aca719b8969
Instruction Fuzzy Hash: 39114F72B19B4282EB068B29F85007977A3FB85B84F544132DA4E6376ADF3DE165CB04

Function 00007FFDA3542BC0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3542BE4
PyErr_Clear.PYTHON313 ref: 00007FFDA3542BFB
PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3542C1F

Strings

lO:AddAccessDeniedAce, xrefs: 00007FFDA3542BDD
AddAccesDeniedAce, xrefs: 00007FFDA3542C40
llO:AddAccessDeniedAce, xrefs: 00007FFDA3542C18

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseTuple$ClearErr_
String ID: AddAccesDeniedAce$lO:AddAccessDeniedAce$llO:AddAccessDeniedAce
API String ID: 2492218514-45297876
Opcode ID: 9257cef95fa0abca0fdc74fa17bf64a4a18db8c9670460e5b188c7a4c9a2dfc3
Instruction ID: d63fdc54d589738b0e8f09a5ea59b30abdae7a94b655940eeaa41571db6c5b0c
Opcode Fuzzy Hash: 9257cef95fa0abca0fdc74fa17bf64a4a18db8c9670460e5b188c7a4c9a2dfc3
Instruction Fuzzy Hash: E6115175B0DB4692DB118F19F4504AAB762FB887C4F444132EA8E53B1AEF3DE254CB48

Function 00007FFDA3542B10 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3542B34
PyErr_Clear.PYTHON313 ref: 00007FFDA3542B4B
PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3542B6F

Strings

llO:AddAccessAllowedAce, xrefs: 00007FFDA3542B68
AddAccesAllowedAce, xrefs: 00007FFDA3542B90
lO:AddAccessAllowedAce, xrefs: 00007FFDA3542B2D

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseTuple$ClearErr_
String ID: AddAccesAllowedAce$lO:AddAccessAllowedAce$llO:AddAccessAllowedAce
API String ID: 2492218514-648165593
Opcode ID: 3ef4422c3111dd9ae3b784dbffad1bbc340a2c81814f7b2475e4556d86d72b89
Instruction ID: 87235f73b2d48bd07a9f05622ca448b0819cb4dcb5e4f5722eb1b818558c54db
Opcode Fuzzy Hash: 3ef4422c3111dd9ae3b784dbffad1bbc340a2c81814f7b2475e4556d86d72b89
Instruction Fuzzy Hash: 9D115175B0DB4682DB118F59F4505AAB762FB887D4F444032EA8E53B2ADF3DE254CB04

Function 00007FFDA35489E0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA3548A07
PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3548A29
SetSecurityDescriptorControl.ADVAPI32 ref: 00007FFDA3548A42

Strings

ll:SetSecurityDescriptorControl, xrefs: 00007FFDA3548A22
SetSecurityDescriptorControl, xrefs: 00007FFDA3548A4E
SetSecurityDescriptorControl does not exist on this platform, xrefs: 00007FFDA35489FD

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ControlDescriptorErr_ParseSecurityStringTuple
String ID: SetSecurityDescriptorControl$SetSecurityDescriptorControl does not exist on this platform$ll:SetSecurityDescriptorControl
API String ID: 1690190277-853495732
Opcode ID: ca04b7d0fea14b1eeca76fa55091ac8873dd5a18c7a071162c64d02978383f12
Instruction ID: 7281c0f0b7eae2242c4afd42101557a26ddfe577411fbbfa3fe96432c0af72a4
Opcode Fuzzy Hash: ca04b7d0fea14b1eeca76fa55091ac8873dd5a18c7a071162c64d02978383f12
Instruction Fuzzy Hash: B0118E61F1A60282EF4A8F1EE86127423A3FF84B84F480031D91E67766DF3EE594C708

Function 00007FFDA3543CF6 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_Py_NewReference.PYTHON313 ref: 00007FFDA3543D38
GetLengthSid.ADVAPI32 ref: 00007FFDA3543D41
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3543D4B
CopySid.ADVAPI32 ref: 00007FFDA3543D5D
Py_BuildValue.PYTHON313 ref: 00007FFDA3543D7B

Strings

(ll)lN, xrefs: 00007FFDA3543D68

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: BuildCopyLengthReferenceValuemalloc
String ID: (ll)lN
API String ID: 1144616375-415220060
Opcode ID: e8749222804a17c14589da8d80a8dfa4130c09778a5ed6446d50b6ac359eea1b
Instruction ID: 168499ec8276c05a2534fdbf7eb47952a6dcdff7bf45826b0d3e1b506c6f23fe
Opcode Fuzzy Hash: e8749222804a17c14589da8d80a8dfa4130c09778a5ed6446d50b6ac359eea1b
Instruction Fuzzy Hash: E0114231F0AB9286EB558F19E46012977A2FB45B80F084035DA8E63766DF3DF561C748

Function 00007FFDA367CDB0 Relevance: 10.5, APIs: 7, Instructions: 37COMMON

Download Yara Rule

APIs

X509_OBJECT_new.LIBCRYPTO-3 ref: 00007FFDA367CDBD
X509_OBJECT_get_type.LIBCRYPTO-3 ref: 00007FFDA367CDD2
X509_OBJECT_get0_X509_CRL.LIBCRYPTO-3 ref: 00007FFDA367CDE5
X509_OBJECT_set1_X509_CRL.LIBCRYPTO-3 ref: 00007FFDA367CDF1
X509_OBJECT_get0_X509.LIBCRYPTO-3 ref: 00007FFDA367CDFC
X509_OBJECT_set1_X509.LIBCRYPTO-3 ref: 00007FFDA367CE08
X509_OBJECT_free.LIBCRYPTO-3 ref: 00007FFDA367CE15

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: X509_$T_get0_T_set1_X509$T_freeT_get_typeT_new
String ID:
API String ID: 4176268728-0
Opcode ID: d20d661c90b5d7aba11b465249715b122b9e2e1b30cf635b5a95bcd50beb5894
Instruction ID: ae25967c13ac1f993dd728470ec9bcbde1a9b73fdb21a1965df810cb794a21ab
Opcode Fuzzy Hash: d20d661c90b5d7aba11b465249715b122b9e2e1b30cf635b5a95bcd50beb5894
Instruction Fuzzy Hash: 0D013120B1FA0385FA645F2669781391363AF49FD4B9C7434C81F6A756DF2EE4988708

Function 00007FFDA354A720 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Py_BuildValue.PYTHON313(?,?,00000000,00007FFDA354A1B2), ref: 00007FFDA354A72F
PyErr_Clear.PYTHON313(?,?,00000000,00007FFDA354A1B2), ref: 00007FFDA354A767
PyErr_SetString.PYTHON313(?,?,00000000,00007FFDA354A1B2), ref: 00007FFDA354A77E
_Py_Dealloc.PYTHON313(?,?,00000000,00007FFDA354A1B2), ref: 00007FFDA354A792

Strings

(i), xrefs: 00007FFDA354A728
invalid timestamp, xrefs: 00007FFDA354A774

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$BuildClearDeallocStringValue
String ID: (i)$invalid timestamp
API String ID: 3614533335-2037815563
Opcode ID: 64888a64718f88c2b21e33994be5d13bf83f3b1d82c56865ddfd3e790820648b
Instruction ID: fb3fb2d38127a5b6594241d7b11e76baf9307e28523874da48ef3577d80498b6
Opcode Fuzzy Hash: 64888a64718f88c2b21e33994be5d13bf83f3b1d82c56865ddfd3e790820648b
Instruction Fuzzy Hash: BA011E61F0BB0281EF568B69E96417823A7AF58B85F481032C90F56766DF3EF5948708

Function 00007FFDA3544A10 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDA3544A34
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3544A44
PyErr_Format.PYTHON313 ref: 00007FFDA3544A70
memcpy.VCRUNTIME140 ref: 00007FFDA3544A82
_Py_NewReference.PYTHON313 ref: 00007FFDA3544A8A

Strings

PyDEVMODE::PyDEVMODE - Unable to allocate DEVMODE of size %d, xrefs: 00007FFDA3544A66

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: memcpy$Err_FormatReferencemalloc
String ID: PyDEVMODE::PyDEVMODE - Unable to allocate DEVMODE of size %d
API String ID: 3577276951-318570358
Opcode ID: 96d05b4b8ad6c57b41a39e5f0ab8f2408ee3286b050f5ce7c13a181665dd239a
Instruction ID: 9c653ab9ad948d1ba0d33e1090c924ab9278dd955a4f68e6577438c8c824f4b4
Opcode Fuzzy Hash: 96d05b4b8ad6c57b41a39e5f0ab8f2408ee3286b050f5ce7c13a181665dd239a
Instruction Fuzzy Hash: 01015E61B0AB0292DF158F4AE96107873A2FF48F85B444035DA4E13B52EF3EF1A4C308

Function 00007FFDA35493F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32 ref: 00007FFDA35493FD
PyErr_SetString.PYTHON313 ref: 00007FFDA3549418
GetSidIdentifierAuthority.ADVAPI32 ref: 00007FFDA354942A
Py_BuildValue.PYTHON313 ref: 00007FFDA3549460

Strings

(BBBBBB), xrefs: 00007FFDA354944F
GetSidIdentifierAuthority: Invalid SID in object, xrefs: 00007FFDA354940E

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: AuthorityBuildErr_IdentifierStringValidValue
String ID: (BBBBBB)$GetSidIdentifierAuthority: Invalid SID in object
API String ID: 4045288465-3761804006
Opcode ID: 615ff364ecf4b2f6fbb4577ac1032b11da4648b0c55427ed7780864fcfb30ffc
Instruction ID: 23e38b78957d5d2ed35422df3e5505f00be957e965998983b9162a078cc91d87
Opcode Fuzzy Hash: 615ff364ecf4b2f6fbb4577ac1032b11da4648b0c55427ed7780864fcfb30ffc
Instruction Fuzzy Hash: 7B01A762B1E7C182DB428F25E8600397FB2FB85B85B088031D99F53762CF2DD565C708

Function 00007FFDA354C890 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA354C8B5
PyErr_SetString.PYTHON313 ref: 00007FFDA354C8DD
IsTextUnicode.ADVAPI32 ref: 00007FFDA354C8F6
Py_BuildValue.PYTHON313 ref: 00007FFDA354C90A

Strings

string size beyond INT_MAX, xrefs: 00007FFDA354C8D3
s#i, xrefs: 00007FFDA354C8AE

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_BuildErr_ParseStringTextTupleUnicodeValue
String ID: s#i$string size beyond INT_MAX
API String ID: 2273782283-3494499060
Opcode ID: 4b5c9164ba692dd86c3d625a5a86657bc7a4acf53301f7ed8babcb47b8e01204
Instruction ID: b20ef0cf36df20b07cf3fb0b4397b35c4cf15329b73ce7dc77dce892473933c5
Opcode Fuzzy Hash: 4b5c9164ba692dd86c3d625a5a86657bc7a4acf53301f7ed8babcb47b8e01204
Instruction Fuzzy Hash: 90018F70F0AB4682DF028B19E4200A937A2FBC5794F800032D54F97B65DE3EF209CB84

Function 00007FFDA354BFF0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Py_MakePendingCalls.PYTHON313 ref: 00007FFDA354BFF4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDA354C005
fprintf.MSPDB140-MSVCRT ref: 00007FFDA354C015

Part of subcall function 00007FFDA354BC60: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDA354BC97

PyErr_Clear.PYTHON313 ref: 00007FFDA354C01A
Py_MakePendingCalls.PYTHON313 ref: 00007FFDA354C020

Strings

Unhandled exception detected before entering Python., xrefs: 00007FFDA354C00E

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: CallsMakePending$ClearErr___acrt_iob_func__stdio_common_vfprintffprintf
String ID: Unhandled exception detected before entering Python.
API String ID: 322838838-920423093
Opcode ID: bbccaab3a7c4ad21d36c60cf5a593e4e3c5db407707c02aee8003046da95ed00
Instruction ID: d098e76ce8edd1bc878d0faa1141bf059b7aaaf2a735683be2e0ed09f8066941
Opcode Fuzzy Hash: bbccaab3a7c4ad21d36c60cf5a593e4e3c5db407707c02aee8003046da95ed00
Instruction Fuzzy Hash: 94E0EC14F0B70392FB0A2B69ECB563926535F54B45F400134C40F61363EE2EF5898618

Function 00007FFDA354B2E0 Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

PyList_New.PYTHON313 ref: 00007FFDA354B320
PyList_Append.PYTHON313 ref: 00007FFDA354B38B
_Py_Dealloc.PYTHON313 ref: 00007FFDA354B3A5

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: List_$AppendDealloc
String ID:
API String ID: 1573934073-0
Opcode ID: 7df2b78d6d5287c60bc640f919dbf0db1eaa50ea8ef363c97fcee23fcdab4804
Instruction ID: f578799c225d72cb8a8a35e45dec4526b401debf67c96b0b39de2ffb1e3b0f53
Opcode Fuzzy Hash: 7df2b78d6d5287c60bc640f919dbf0db1eaa50ea8ef363c97fcee23fcdab4804
Instruction Fuzzy Hash: 3B315331F0B64287EB5A4F1E956417862A3EF047A4F084230DA9E17BD6EF6EF5518344

Function 00007FFDA354B420 Relevance: 9.1, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

PyList_New.PYTHON313 ref: 00007FFDA354B460
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFDA354B496
PyList_Append.PYTHON313 ref: 00007FFDA354B4AA
_Py_Dealloc.PYTHON313 ref: 00007FFDA354B4C4

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: List_$AppendBytes_DeallocFromSizeString
String ID:
API String ID: 3583985797-0
Opcode ID: fa9e8c22ace8bfa2a7f8576b109cd451eb3fbd3c9cda2f4208ba26d535e53f9c
Instruction ID: 8d602ccf3f2c1c0bfcff0f07817e5db54a8ddfda4778307fed2b50d680553d87
Opcode Fuzzy Hash: fa9e8c22ace8bfa2a7f8576b109cd451eb3fbd3c9cda2f4208ba26d535e53f9c
Instruction Fuzzy Hash: 1B315431F0B64146EE5E4F29B5742786693AF05BA4F085234DAAE177C6DF2EF4418308

Function 00007FFDA3546FF0 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

_Py_NewReference.PYTHON313(?,?,?,00007FFDA3546F26), ref: 00007FFDA354700D

Part of subcall function 00007FFDA354E768: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354E782

_Py_NewReference.PYTHON313(?,?,?,00007FFDA3546F26), ref: 00007FFDA354703A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA3546F26), ref: 00007FFDA3547045
InitializeSecurityDescriptor.ADVAPI32(?,?,?,00007FFDA3546F26), ref: 00007FFDA354705E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA3546F26), ref: 00007FFDA3547076
_Py_Dealloc.PYTHON313(?,?,?,00007FFDA3546F26), ref: 00007FFDA354709A

Part of subcall function 00007FFDA3547D20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D3B
Part of subcall function 00007FFDA3547D20: GetSecurityDescriptorLength.ADVAPI32(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D44

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: DescriptorReferenceSecurityfreemalloc$DeallocInitializeLength
String ID:
API String ID: 2040291429-0
Opcode ID: 5a263e4a360b5c9879a8c6137d038cbb60ca2fb05632f21eee30b9500df43a29
Instruction ID: 1acd5d4a560846bc13a9c05859691063b22a1b1c176d5a2093ebfa9b92df8792
Opcode Fuzzy Hash: 5a263e4a360b5c9879a8c6137d038cbb60ca2fb05632f21eee30b9500df43a29
Instruction Fuzzy Hash: BE215331F0BB4282EB0A8F19E86432977A6FB48B80F444034CA5E17B56DF3EE564C744

Function 00007FFDA354DA70 Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FFDA354DA7C
PyThreadState_Delete.PYTHON313 ref: 00007FFDA354DA93
TlsSetValue.KERNEL32 ref: 00007FFDA354DAA1
LocalFree.KERNEL32 ref: 00007FFDA354DAAA
_Py_Dealloc.PYTHON313 ref: 00007FFDA354DACF
_Py_Dealloc.PYTHON313 ref: 00007FFDA354DAF2

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: DeallocValue$DeleteFreeLocalState_Thread
String ID:
API String ID: 1066789969-0
Opcode ID: d72e0d609fdda2483786e1d5aaac3537aadc1cecc1d2818175353a1866a79386
Instruction ID: df5731fa17354c41344a8d382af9c0b78e5a6a79ddc8ad08e5a29ad3aa9b8791
Opcode Fuzzy Hash: d72e0d609fdda2483786e1d5aaac3537aadc1cecc1d2818175353a1866a79386
Instruction Fuzzy Hash: 14119635F0B74281FB5A8F6EA87503822E3AF49755F084134C90E62353DF3EB5558B09

Function 00007FFDA3547DE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3547E0A
InitializeSecurityDescriptor.ADVAPI32 ref: 00007FFDA3547E2E

Strings

InitializeSecurityDescriptor, xrefs: 00007FFDA3547E3A
:Initialize, xrefs: 00007FFDA3547DF9

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_DescriptorInitializeParseSecurityTuple
String ID: :Initialize$InitializeSecurityDescriptor
API String ID: 3008588735-475701968
Opcode ID: bcb71fab1ef2345fa760387ba95d939ceb0289144ad845e36b1c36082859699f
Instruction ID: e732b524581cecce641c0220c102e0454868fc8579aba0b6c966919a004ab03c
Opcode Fuzzy Hash: bcb71fab1ef2345fa760387ba95d939ceb0289144ad845e36b1c36082859699f
Instruction Fuzzy Hash: F8219922B1D74182EB4A8F2AF55017A63A3FF48BC0F485031DE5E57B5ADF2DE8518704

Function 00007FFDA35455D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00007FFDA35456A7
PyUnicode_FromWideChar.PYTHON313 ref: 00007FFDA35456CF
PyObject_Print.PYTHON313 ref: 00007FFDA35456E4
_Py_Dealloc.PYTHON313 ref: 00007FFDA35456F8

Strings

<%hs at %Id (%Id)>, xrefs: 00007FFDA354568F

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: CharDeallocFromObject_PrintUnicode_Widewsprintf
String ID: <%hs at %Id (%Id)>
API String ID: 2754229576-3200932714
Opcode ID: d6e00180c53ce781e79f886e838ef22ec9f51abfd2b976ddd751f53c605734fa
Instruction ID: 60d5abafb81b1847415d08b690ec3aee50131b3f76d1ba87c44a061bc9f8ed31
Opcode Fuzzy Hash: d6e00180c53ce781e79f886e838ef22ec9f51abfd2b976ddd751f53c605734fa
Instruction Fuzzy Hash: BA11E432F06B4581EF568B29E8243A867A2EB48FE4F444130D91E137A5DF3DE144C304

Function 00007FFDA3545980 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA35459A5
_Py_NewReference.PYTHON313 ref: 00007FFDA3545A34

Strings

The object is not a PyHANDLE object, xrefs: 00007FFDA35459E9
|O:HANDLERegistry, xrefs: 00007FFDA354599E

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseReferenceTuple
String ID: The object is not a PyHANDLE object$|O:HANDLERegistry
API String ID: 709158290-3143913545
Opcode ID: c51ad50cdd8a4e81500241ab1d12deaa1fc53d1bb5ae0f20817fe087472034bc
Instruction ID: 1408b51086a47ec0d7e71c07bbc501f1af7bbfb5a9c609347b7f11cece9b7d43
Opcode Fuzzy Hash: c51ad50cdd8a4e81500241ab1d12deaa1fc53d1bb5ae0f20817fe087472034bc
Instruction Fuzzy Hash: B9219F32B0AB8291EA468F19F4A007973B2FB44784F540032EB4E63766DF3EE569C744

Function 00007FFDA3545080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA35450A5
_Py_NewReference.PYTHON313 ref: 00007FFDA3545134

Strings

The object is not a PyHANDLE object, xrefs: 00007FFDA35450E9
|O:HANDLE, xrefs: 00007FFDA354509E

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseReferenceTuple
String ID: The object is not a PyHANDLE object$|O:HANDLE
API String ID: 709158290-2911939918
Opcode ID: d524b3afff0263af5fd17325481d8d0d46617f7d59757ba0433345372724a13d
Instruction ID: 73e7ca5cc1eed1b90fa0398aca9e917d47310d2de4053cb928facc46f1d8ff00
Opcode Fuzzy Hash: d524b3afff0263af5fd17325481d8d0d46617f7d59757ba0433345372724a13d
Instruction Fuzzy Hash: 83218E22B0AB8281EA468B19F46007963B2FB44784F541432EA4E67B66DF3EE565C744

Function 00007FFDA354C9C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA354C9E7
DosDateTimeToFileTime.KERNEL32 ref: 00007FFDA354CA14

Strings

FileTimeToSystemTime, xrefs: 00007FFDA354CA54
DosDateTimeToFileTime, xrefs: 00007FFDA354CA20

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Time$Arg_DateFileParseTuple
String ID: DosDateTimeToFileTime$FileTimeToSystemTime
API String ID: 1545533762-3006328108
Opcode ID: 6a8d318ddad729e7252b3c6980ed207a389d14d8fbb48f996d8d5cf78618f2e3
Instruction ID: 7f0c2a7808488bca8316bd51b7e9ce8672087254b41fca754ad02b6ff8dfcc1e
Opcode Fuzzy Hash: 6a8d318ddad729e7252b3c6980ed207a389d14d8fbb48f996d8d5cf78618f2e3
Instruction Fuzzy Hash: B0117B12F0D98291EE56EB26E8310BA7363FFC5748FC40032E54E52757EE2EE5058B04

Function 00007FFDA3541990 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDA35419D4
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35419E6
PyErr_Format.PYTHON313 ref: 00007FFDA3541A0D

Strings

SetACL: Unable to reallocate ACL to size %d, xrefs: 00007FFDA35419FC

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_Formatmemcpyrealloc
String ID: SetACL: Unable to reallocate ACL to size %d
API String ID: 2667793433-1849531889
Opcode ID: 6ba060cef578a0feeb06df177a6597eb8244b50008ebb1effcf474d1aa7c220c
Instruction ID: f61f81f3cd85f40cd4b87e5bbb0513c3dc05e3359ba1d6c97596e252bde295fc
Opcode Fuzzy Hash: 6ba060cef578a0feeb06df177a6597eb8244b50008ebb1effcf474d1aa7c220c
Instruction Fuzzy Hash: BB119321B1A75182EB199F16E85103AB3B2FB48FC0B048035EE5D57B46DF3DE1908348

Function 00007FFDA3544DD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA3544E16
PyErr_SetString.PYTHON313 ref: 00007FFDA3544E47

Strings

Object must be a PyDEVMODEW, xrefs: 00007FFDA3544E3D
PyDEVMODE cannot be None in this context, xrefs: 00007FFDA3544E0C

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_String
String ID: Object must be a PyDEVMODEW$PyDEVMODE cannot be None in this context
API String ID: 1450464846-2899910425
Opcode ID: 3c20b954deb9a9200817a31d63ae06041e07210914048fb5353322c95aff8119
Instruction ID: 5538eaffaddb77e073174aadaf3c06aa5bacc7f95c059e92092e695c99cfb3f7
Opcode Fuzzy Hash: 3c20b954deb9a9200817a31d63ae06041e07210914048fb5353322c95aff8119
Instruction Fuzzy Hash: A7119462F1AB0281EF558F1DF49027823A2FB88BC4F484031DA1E47B66DE3EE591C708

Function 00007FFDA36745D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA3673CEC: PyType_IsSubtype.PYTHON313 ref: 00007FFDA3673CF9

_Py_Dealloc.PYTHON313 ref: 00007FFDA367461B
SSL_set_SSL_CTX.LIBSSL-3 ref: 00007FFDA367462D
SSL_set_msg_callback.LIBSSL-3 ref: 00007FFDA367464F
PyErr_SetString.PYTHON313 ref: 00007FFDA367466A

Strings

The value must be a SSLContext, xrefs: 00007FFDA3674660

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: DeallocErr_L_set_L_set_msg_callbackStringSubtypeType_
String ID: The value must be a SSLContext
API String ID: 40619448-677980480
Opcode ID: 1305fe11475873808bc867462c34bc72e04dd9ebe05a14b25f697de9632d2ea4
Instruction ID: 714060bc16f180b938aba2aaf048abe4bce4e17cf65aa84c2e615d9c364bc7a7
Opcode Fuzzy Hash: 1305fe11475873808bc867462c34bc72e04dd9ebe05a14b25f697de9632d2ea4
Instruction Fuzzy Hash: EA1151B2B09A4182FB14CF25D96912833B2FB48FC8B586131CA5D57366CF2AD464C344

Function 00007FFDA3549350 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3549370
GetSidSubAuthorityCount.ADVAPI32 ref: 00007FFDA3549385
GetSidSubAuthority.ADVAPI32 ref: 00007FFDA354939A
PyErr_SetString.PYTHON313 ref: 00007FFDA35493D4

Strings

The index is out of range, xrefs: 00007FFDA35493CA

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Authority$Arg_CountErr_ParseStringTuple
String ID: The index is out of range
API String ID: 706982848-505141048
Opcode ID: d87ec0b1fcf0a1068b55480798adcdb78cb2436f0da94cff30977aef3b577662
Instruction ID: 8d2309c1be11ffc55dd01463e80debff9e4f7070a9a1a6165cb93596f3e26ec3
Opcode Fuzzy Hash: d87ec0b1fcf0a1068b55480798adcdb78cb2436f0da94cff30977aef3b577662
Instruction Fuzzy Hash: C2117C72F1A74282EF0A8F19E4600783362FB88B40F445032DA0E53766DF3DE584CB48

Function 00007FFDA354D0E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

PyLong_AsVoidPtr.PYTHON313 ref: 00007FFDA354D0F5
PyErr_Occurred.PYTHON313 ref: 00007FFDA354D103
PyErr_Clear.PYTHON313 ref: 00007FFDA354D10E

Part of subcall function 00007FFDA354CEB0: PyNumber_Long.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEC5
Part of subcall function 00007FFDA354CEB0: PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CED3
Part of subcall function 00007FFDA354CEB0: PyLong_AsLongLong.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEE1
Part of subcall function 00007FFDA354CEB0: PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEF0
Part of subcall function 00007FFDA354CEB0: PyErr_Clear.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEFB
Part of subcall function 00007FFDA354CEB0: PyLong_AsUnsignedLongLong.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF04
Part of subcall function 00007FFDA354CEB0: PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF13
Part of subcall function 00007FFDA354CEB0: _Py_Dealloc.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF2C
Part of subcall function 00007FFDA354CEB0: PyErr_Format.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF4B

PyErr_Format.PYTHON313 ref: 00007FFDA354D13C

Strings

WPARAM is simple, so must be an int object (got %s), xrefs: 00007FFDA354D127

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$Long$Occurred$Long_$ClearFormat$DeallocNumber_UnsignedVoid
String ID: WPARAM is simple, so must be an int object (got %s)
API String ID: 4021378859-3057595559
Opcode ID: 650d8dcc8cadc460fa6b0e6a961d0bec92543f936dcd9b3b363ec97f9a6b6c7e
Instruction ID: 4930e160f674d414c1c8428b8b88fec3f0b11690d302b28a8278c9bf6f240464
Opcode Fuzzy Hash: 650d8dcc8cadc460fa6b0e6a961d0bec92543f936dcd9b3b363ec97f9a6b6c7e
Instruction Fuzzy Hash: 67018021F0AB8281EF458B1AF46006967A2EF48BC4F085031EE0E67716DE3DE494C708

Function 00007FFDA367B390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

X509_get_subject_name.LIBCRYPTO-3 ref: 00007FFDA367B3AA
PyType_GetModuleState.PYTHON313 ref: 00007FFDA367B3B6

Part of subcall function 00007FFDA367B1CC: BIO_s_mem.LIBCRYPTO-3 ref: 00007FFDA367B1E6
Part of subcall function 00007FFDA367B1CC: BIO_new.LIBCRYPTO-3 ref: 00007FFDA367B1EF
Part of subcall function 00007FFDA367B1CC: PyErr_SetString.PYTHON313 ref: 00007FFDA367B210

PyUnicode_FromFormat.PYTHON313 ref: 00007FFDA367B3E1
_Py_Dealloc.PYTHON313 ref: 00007FFDA367B3F8

Strings

<%s '%U'>, xrefs: 00007FFDA367B3D3

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: DeallocErr_FormatFromModuleO_newO_s_memStateStringType_Unicode_X509_get_subject_name
String ID: <%s '%U'>
API String ID: 652521511-3496504151
Opcode ID: ac0ec37f53dc304a1c658a581da0e647366d60a2732bb4336fb4d754c58b5739
Instruction ID: 3d846345c633cbf4b630d70d546377375cc0b9c6f0545b341df8843c7dda123a
Opcode Fuzzy Hash: ac0ec37f53dc304a1c658a581da0e647366d60a2732bb4336fb4d754c58b5739
Instruction Fuzzy Hash: 36016721B0A64282FE448F17E9641296362FB48FD4F8C6430DE5D1776ADF3DE485C704

Function 00007FFDA354D660 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

PyLong_FromLongLong.PYTHON313 ref: 00007FFDA354D676
PyLong_FromLongLong.PYTHON313 ref: 00007FFDA354D683
PyLong_FromLongLong.PYTHON313 ref: 00007FFDA354D68F
Py_BuildValue.PYTHON313 ref: 00007FFDA354D6C0

Strings

NiNNi(ii), xrefs: 00007FFDA354D6B4

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Long$FromLong_$BuildValue
String ID: NiNNi(ii)
API String ID: 3269351011-1588869203
Opcode ID: 395cab98014d2c388113e4450b3a3dd1ebaa526a5b2c7052f1148e00d7086c69
Instruction ID: 2f8fc14a2b8eb67bf36a5d3da76340e8a450f1ec3f970758f57d6d54ced6a964
Opcode Fuzzy Hash: 395cab98014d2c388113e4450b3a3dd1ebaa526a5b2c7052f1148e00d7086c69
Instruction Fuzzy Hash: 2101C836A0974187DB20CF56F49442AB7A1F78CB90B144125EB8F53B15DF3DE545CB04

Function 00007FFDA3547D20 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D3B
GetSecurityDescriptorLength.ADVAPI32(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D44
GetSecurityDescriptorControl.ADVAPI32(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D73
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D8C
memcpy.VCRUNTIME140(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D9F

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: DescriptorSecurity$ControlLengthfreemallocmemcpy
String ID:
API String ID: 3383347431-0
Opcode ID: 00db8a8ef03e6ccfc7907ca2be9497b938e4a031f4901367d256bfa0d2a9a409
Instruction ID: 1f725fa621c40c947f8340cabd122506d2bf430e8e52bc02e0a5a2387b73c088
Opcode Fuzzy Hash: 00db8a8ef03e6ccfc7907ca2be9497b938e4a031f4901367d256bfa0d2a9a409
Instruction Fuzzy Hash: 9011D322B09B4182FF0A8B6EE9601F95366EB89BD4F080035EF1D47B92DF2DD9958704

Function 00007FFDA3548BE0 Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

_Py_NewReference.PYTHON313(?,?,?,00007FFDA354715D,?,?,?,00007FFDA3546F53), ref: 00007FFDA3548BFD
GetSecurityDescriptorLength.ADVAPI32(?,?,?,00007FFDA354715D,?,?,?,00007FFDA3546F53), ref: 00007FFDA3548C0E
GetSecurityDescriptorControl.ADVAPI32(?,?,?,00007FFDA354715D,?,?,?,00007FFDA3546F53), ref: 00007FFDA3548C3F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA354715D,?,?,?,00007FFDA3546F53), ref: 00007FFDA3548C58
memcpy.VCRUNTIME140(?,?,?,00007FFDA354715D,?,?,?,00007FFDA3546F53), ref: 00007FFDA3548C6B

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: DescriptorSecurity$ControlLengthReferencemallocmemcpy
String ID:
API String ID: 3412238872-0
Opcode ID: c15fc75f51fb05eaa94f12650e5f0670c83e32bb2e77d43decb978ab075af439
Instruction ID: bc135625a2c3a4b7c04e34ef256d8b20192222aae648b74780d78d775700b5ac
Opcode Fuzzy Hash: c15fc75f51fb05eaa94f12650e5f0670c83e32bb2e77d43decb978ab075af439
Instruction Fuzzy Hash: 5911D322B05B4182FB059B5EE9103A96266FB84BD5F080031CF5D07B91DF3EE5E5C314

Function 00007FFDA3549FA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA354A010
PyErr_SetString.PYTHON313 ref: 00007FFDA354A09D

Strings

year out of range, xrefs: 00007FFDA354A093
iiiiiiiii|i, xrefs: 00007FFDA354A009

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_Err_ParseStringTuple
String ID: iiiiiiiii|i$year out of range
API String ID: 385655187-1001734015
Opcode ID: a393630f01c1ab398363936785eebc4b854c9c0a34006ea8152fcf8c0a72c652
Instruction ID: 9b1bd0618c7111ac4154202383266a6489a4299dfc87566f265a5d173dd1dac0
Opcode Fuzzy Hash: a393630f01c1ab398363936785eebc4b854c9c0a34006ea8152fcf8c0a72c652
Instruction Fuzzy Hash: A531FFB2B09B0186E708CF18D4545AC33BAF748B80B55823ACBAD53701DF3AE9E5C744

Function 00007FFDA354A5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72timeCOMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFDA354A653
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FFDA354A67F
VariantTimeToSystemTime.OLEAUT32 ref: 00007FFDA354A6BA

Strings

VariantTimeToSystemTime, xrefs: 00007FFDA354A6C6

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Timefloor$SystemVariant
String ID: VariantTimeToSystemTime
API String ID: 1266533630-2676162551
Opcode ID: a465e119b1e8654e6b17b5d4bd19b62b8ede92bf3e9ff217748a048bfc1d5ad1
Instruction ID: 9f1136182554c97e166fd00c6c51920208f976b05da7dd68089920173582b300
Opcode Fuzzy Hash: a465e119b1e8654e6b17b5d4bd19b62b8ede92bf3e9ff217748a048bfc1d5ad1
Instruction Fuzzy Hash: 56316651E29FD544E28397399861075E35B6FA6789B049333F89E72727EF2AF0C24604

Function 00007FFDA354D570 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA354D5B2

Strings

OiOOi(ii):MSG param, xrefs: 00007FFDA354D5AB
The object is not a PyHANDLE object, xrefs: 00007FFDA354D639

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: OiOOi(ii):MSG param$The object is not a PyHANDLE object
API String ID: 3371842430-2297966167
Opcode ID: 1aef02047203e126fbad942446429c40e2ebc0da5cb29cf657f2d8b5da010051
Instruction ID: 43beafebb6b28b78217567ea70c73095aa4a9e50e0d20ff22012bc05d95df3df
Opcode Fuzzy Hash: 1aef02047203e126fbad942446429c40e2ebc0da5cb29cf657f2d8b5da010051
Instruction Fuzzy Hash: A7218072B0AB0681EF02CF19D4500A973E7FB84B84F444032CA0D57366EF3AE965CB44

Function 00007FFDA3549120 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3549177
InitializeSid.ADVAPI32 ref: 00007FFDA35491A5

Strings

(bbbbbb)b:Initialize, xrefs: 00007FFDA3549155
InitializeSid, xrefs: 00007FFDA35491B1

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_InitializeParseTuple
String ID: (bbbbbb)b:Initialize$InitializeSid
API String ID: 1991639834-750340051
Opcode ID: 8f93dc5897869b6e6d762fe8350b58cad0134a8ca8a8ee9a4feec80ce2d05c27
Instruction ID: 0db3852659f00c227d801c82db42b917714c8130bfe9cecc58f4805213788b78
Opcode Fuzzy Hash: 8f93dc5897869b6e6d762fe8350b58cad0134a8ca8a8ee9a4feec80ce2d05c27
Instruction Fuzzy Hash: 4121A132B1AB8281EF06CF16E4650BD33A2FB88784B450036DA2E47752DF3EE959C704

Function 00007FFDA3543E8C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3543ECB
DeleteAce.ADVAPI32 ref: 00007FFDA3543EE5

Strings

DeleteAce, xrefs: 00007FFDA3543EF1
l:DeleteAce, xrefs: 00007FFDA3543EC1

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_DeleteParseTuple
String ID: DeleteAce$l:DeleteAce
API String ID: 1230908747-3702189175
Opcode ID: e9fd5093a37588dd38093529aa320f1bd4afb36f3cc09021ea466ad982abeb09
Instruction ID: c85a5491b28fe02842b44416f7484fd7ff647ba7beaa871d19b1bdee62e8a248
Opcode Fuzzy Hash: e9fd5093a37588dd38093529aa320f1bd4afb36f3cc09021ea466ad982abeb09
Instruction Fuzzy Hash: 9B113362B1E3C247DB074F69E4601B93F72EF89B44B488072D68E93353D92DE5A6C704

Function 00007FFDA3544E90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON313 ref: 00007FFDA3544EE3

Strings

DEVMODE structure of size %d greater than supported size of %d, xrefs: 00007FFDA3544ED6

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_Format
String ID: DEVMODE structure of size %d greater than supported size of %d
API String ID: 376477240-1470040908
Opcode ID: b8ecc243b236786a1011e640928dcb070ff00ad600dd3a87fa9598167f5ce84a
Instruction ID: 6870ff2fb874b4da6f5e41b20de780402ffe48e4837abc375bb8095437af22c1
Opcode Fuzzy Hash: b8ecc243b236786a1011e640928dcb070ff00ad600dd3a87fa9598167f5ce84a
Instruction Fuzzy Hash: 7A118261F5770281EF1A8F6ED46533822E3EB48B94F444030DD0E57792DE3EE5918748

Function 00007FFDA3548250 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3548266
GetSecurityDescriptorOwner.ADVAPI32 ref: 00007FFDA3548286

Strings

:GetSecurityDescriptorOwner, xrefs: 00007FFDA354825F
GetSecurityDescriptorOwner, xrefs: 00007FFDA3548292

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_DescriptorOwnerParseSecurityTuple
String ID: :GetSecurityDescriptorOwner$GetSecurityDescriptorOwner
API String ID: 2338322640-1512101531
Opcode ID: 0535b539f90f532cb0c8c7548f6890f1e389f6ab6250c068e08cb84b90928d65
Instruction ID: c7c063caed345cb5110894e8388db5adb9d737835694dd8096d07f12fa09926d
Opcode Fuzzy Hash: 0535b539f90f532cb0c8c7548f6890f1e389f6ab6250c068e08cb84b90928d65
Instruction Fuzzy Hash: A301C861F0AA0282EF0E8B5EF86027523A3FF84784F444031DA0D53756EE2EE595C708

Function 00007FFDA367B280 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

PyUnicode_InternFromString.PYTHON313(?,?,00000000,00007FFDA367A90A), ref: 00007FFDA367B29B
PyUnicode_InternFromString.PYTHON313(?,?,00000000,00007FFDA367A90A), ref: 00007FFDA367B2C0

Strings

pkcs_7_asn, xrefs: 00007FFDA367B2B9
x509_asn, xrefs: 00007FFDA367B294

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: FromInternStringUnicode_
String ID: pkcs_7_asn$x509_asn
API String ID: 3337471625-3375957347
Opcode ID: 558d5d3a9ef559b9bb73cef6fa9e1e05407cb85e81fbae4b2e71b342289d17a6
Instruction ID: 2896cecedd4ded772a28da1d07b8e0f6b90c1c628111cc63a56acfac9396a8a4
Opcode Fuzzy Hash: 558d5d3a9ef559b9bb73cef6fa9e1e05407cb85e81fbae4b2e71b342289d17a6
Instruction Fuzzy Hash: 3E110031F1BA4787FA558F59E8701382392AF49750B9C2434C81D673A2EF2EF895C61C

Function 00007FFDA3545240 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

Strings

CloseHandle, xrefs: 00007FFDA35452C8
The object is not a PyHANDLE object, xrefs: 00007FFDA3545283

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID:
String ID: CloseHandle$The object is not a PyHANDLE object
API String ID: 0-4264222050
Opcode ID: dc318d2b1349d4a50ab063cf74b006e41aa0c775c8383e0438a78d5d1f98fbfa
Instruction ID: 245b94c606e020aa45069ae0ae16717313afa6997a22888d6d07cd57f625b45c
Opcode Fuzzy Hash: dc318d2b1349d4a50ab063cf74b006e41aa0c775c8383e0438a78d5d1f98fbfa
Instruction Fuzzy Hash: 1C118221F1FA02C2EE56CB1DD8A013963A3FF88758F840532D61E97792EF2EE5558308

Function 00007FFDA3676B58 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON313 ref: 00007FFDA3676B96
PyLong_AsInt.PYTHON313 ref: 00007FFDA3676BA9
PyErr_Occurred.PYTHON313 ref: 00007FFDA3676BB6

Strings

read, xrefs: 00007FFDA3676B8F

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Arg_CheckErr_Long_OccurredPositional
String ID: read
API String ID: 3612027452-2555855207
Opcode ID: 306359e4f8596419864749e46a6279d9dcbf16e10bf7bab82334e129a622ebfc
Instruction ID: a86554c19908fcc82469600758bd7cf87e6bae5e743d67989628f022659a16bb
Opcode Fuzzy Hash: 306359e4f8596419864749e46a6279d9dcbf16e10bf7bab82334e129a622ebfc
Instruction Fuzzy Hash: E701D632F06B5185F6909F26A85402567B2EB8AF90B8C2131DE1D67796CF3EE455C704

Function 00007FFDA354C920 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA354C93D
CoCreateGuid.OLE32 ref: 00007FFDA354C965
_Py_NewReference.PYTHON313 ref: 00007FFDA354C98B

Strings

:CreateGuid, xrefs: 00007FFDA354C936

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_CreateGuidParseReferenceTuple
String ID: :CreateGuid
API String ID: 1283042906-3559396464
Opcode ID: 406caab003073a4f77f67d61481f4c1e26270bd55b296c2a684b999cc2a37536
Instruction ID: fcfa1919cc88bef3a6cfda5f985d358566d56f3c3776be78111e113f638d9e0d
Opcode Fuzzy Hash: 406caab003073a4f77f67d61481f4c1e26270bd55b296c2a684b999cc2a37536
Instruction Fuzzy Hash: D9019262F09B4181EA459B29E82116973A2FB89794F841135DA4F53327EF3DF1808B04

Function 00007FFDA3541B30 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3541B47
InitializeAcl.ADVAPI32 ref: 00007FFDA3541B64

Strings

InitializeAcl, xrefs: 00007FFDA3541B70
:Initialize, xrefs: 00007FFDA3541B40

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_InitializeParseTuple
String ID: :Initialize$InitializeAcl
API String ID: 1991639834-2627007299
Opcode ID: 393eb0023e6c4a67651202f94622b7c3e74f33b7195f251b897bfafc05145604
Instruction ID: 9f7ec1c03af4e7fd57993548394788666588741d72735de5197e6b83143227a4
Opcode Fuzzy Hash: 393eb0023e6c4a67651202f94622b7c3e74f33b7195f251b897bfafc05145604
Instruction Fuzzy Hash: A3F06861F5A60682EF1A8F2EEC7017523A3EF48F84B484031C90E57362EE2DF595D708

Function 00007FFDA35460C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

StringFromGUID2.OLE32 ref: 00007FFDA35460E4
PyErr_SetString.PYTHON313 ref: 00007FFDA35460FF
PyUnicode_FromWideChar.PYTHON313 ref: 00007FFDA354613F

Strings

The string is too long, xrefs: 00007FFDA35460F5

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: FromString$CharErr_Unicode_Wide
String ID: The string is too long
API String ID: 1358704699-1150129668
Opcode ID: 3e50894a2f6329b4e245a6427f8e7c1b14ee148e69ae879c50c0a09b0fbc83e2
Instruction ID: a86b8b235df33d00075b607d17e14f205b8f3527d1bcfa5cf0ba4b606aa899d2
Opcode Fuzzy Hash: 3e50894a2f6329b4e245a6427f8e7c1b14ee148e69ae879c50c0a09b0fbc83e2
Instruction Fuzzy Hash: 0901B531F06A8181EF619B18E8613B923A2FF8C764F800231D5AE537E2DE2DE2048708

Function 00007FFDA3545420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FFDA354543A
CloseHandle.KERNEL32 ref: 00007FFDA3545447
PyEval_RestoreThread.PYTHON313 ref: 00007FFDA3545452

Part of subcall function 00007FFDA354C400: GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C41B
Part of subcall function 00007FFDA354C400: FormatMessageW.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C48A
Part of subcall function 00007FFDA354C400: PyUnicode_DecodeMBCS.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C568
Part of subcall function 00007FFDA354C400: Py_BuildValue.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C57D
Part of subcall function 00007FFDA354C400: LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C595
Part of subcall function 00007FFDA354C400: PyErr_SetObject.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C5AA

Strings

CloseHandle, xrefs: 00007FFDA354546B

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Eval_Thread$BuildCloseDecodeErr_ErrorFormatFreeHandleLastLocalMessageObjectRestoreSaveUnicode_Value
String ID: CloseHandle
API String ID: 2231686540-2962429428
Opcode ID: 083de3100d951dd9bdb6f7860e10261bd61e50a463827633fdd8d26adf2132cc
Instruction ID: 4884b1baabd48e5122f3b3f554207b787d19b85b8c75067eef9245ee5eab7d99
Opcode Fuzzy Hash: 083de3100d951dd9bdb6f7860e10261bd61e50a463827633fdd8d26adf2132cc
Instruction Fuzzy Hash: D4F0F636F0A74082EF569B2AF45037962A2FF88784F080030DA4F57756CE3DE4C28744

Function 00007FFDA354FC10 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__current_exception.VCRUNTIME140 ref: 00007FFDA354FC51
__current_exception_context.VCRUNTIME140 ref: 00007FFDA354FC5D
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA354FC65

Strings

csm, xrefs: 00007FFDA354FC20

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: 3b4c1db84a87a6fdb22006f661c73e75c067a881438bcbb587b3e6fc569e0f3a
Instruction ID: e783e50472f7c2166cdafe020047a158d1aa93587a888ad5e4abd68369c505ab
Opcode Fuzzy Hash: 3b4c1db84a87a6fdb22006f661c73e75c067a881438bcbb587b3e6fc569e0f3a
Instruction Fuzzy Hash: 6BF09032B0924696DB1A5FADE09806D23A3FB08B48F648432DB4817746DE39E890C705

Function 00007FFDA3550248 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__current_exception.VCRUNTIME140 ref: 00007FFDA355027D
__current_exception_context.VCRUNTIME140 ref: 00007FFDA3550291
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3550299

Strings

csm, xrefs: 00007FFDA3550269

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: b86dd0a1a1710a2c7cd3376dcc4a259a6d59bebf1e1d349f78f65613216423d0
Instruction ID: e14af70108b792718e7e04efe8063806f537b60073f81f62043ff0b3cf2e27c8
Opcode Fuzzy Hash: b86dd0a1a1710a2c7cd3376dcc4a259a6d59bebf1e1d349f78f65613216423d0
Instruction Fuzzy Hash: B3F0673760AB80CEC7569F69E8904AC3365F74DB88B895131FA4D57756CF38D890C300

Function 00007FFDA3674BD8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFDA3674BFA
PyUnicode_DecodeUTF8.PYTHON313 ref: 00007FFDA3674C14
PyErr_SetString.PYTHON313 ref: 00007FFDA3674C2D

Strings

Not a memory BIO, xrefs: 00007FFDA3674C23

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: DecodeErr_O_ctrlStringUnicode_
String ID: Not a memory BIO
API String ID: 3520065620-587638661
Opcode ID: f1e569248959cc17e58cb0b44c7309055625ae041323eb1d6d1c9383251d7a75
Instruction ID: 4f472ad3aee5a7e0c9a9335ff6b964dc6732299eb9b1277e3fd5d03ace27223e
Opcode Fuzzy Hash: f1e569248959cc17e58cb0b44c7309055625ae041323eb1d6d1c9383251d7a75
Instruction Fuzzy Hash: ADF09061B2B64682FB04CF61E4687742362FF89B84F886431ED0E5A716DF2DE0488704

Function 00007FFDA3546330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

StringFromGUID2.OLE32 ref: 00007FFDA354635B
wsprintfW.USER32 ref: 00007FFDA3546375
PyUnicode_FromWideChar.PYTHON313 ref: 00007FFDA354639F

Strings

IID('%ws'), xrefs: 00007FFDA3546369

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: From$CharStringUnicode_Widewsprintf
String ID: IID('%ws')
API String ID: 3341265217-2301737843
Opcode ID: 74d81495bdbc85cec00b5cd67ca454c2b63e3e3fa1d9bcce47121b153791d4b7
Instruction ID: a62cea9af163af99de8d4d1c79407b1d14882a7b1f66e440ea0bef13d5aa8c1e
Opcode Fuzzy Hash: 74d81495bdbc85cec00b5cd67ca454c2b63e3e3fa1d9bcce47121b153791d4b7
Instruction Fuzzy Hash: B1F08162B09B8691EF619B04E4603A96371FB88764F800331C5AE137E6DF2CE249CB04

Function 00007FFDA354D340 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA354D368
PyArg_ParseTuple.PYTHON313 ref: 00007FFDA354D398

Strings

RECT must be a tuple of 4 ints (left, top, right, bottom), xrefs: 00007FFDA354D35E
llll;RECT must be a tuple of 4 ints (left, top, right, bottom), xrefs: 00007FFDA354D38E

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_Err_ParseStringTuple
String ID: RECT must be a tuple of 4 ints (left, top, right, bottom)$llll;RECT must be a tuple of 4 ints (left, top, right, bottom)
API String ID: 385655187-1420951713
Opcode ID: 4fb09c2bb181abc938ff80eaaac510f2ee71be2d2c87fa52025b76ed328b3842
Instruction ID: 1a019850a18e85712d824113c4f93567c47fc4a4f979e12296ae5dcc86619b79
Opcode Fuzzy Hash: 4fb09c2bb181abc938ff80eaaac510f2ee71be2d2c87fa52025b76ed328b3842
Instruction Fuzzy Hash: 9CF03AA5B05B8590DA01CF18D4601A977A2FB89B94FC48132CA4E53721EE3DE259CB04

Function 00007FFDA3674ABC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFDA3674ADA
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFDA3674AF1
PyErr_SetString.PYTHON313 ref: 00007FFDA3674B0A

Strings

Not a memory BIO, xrefs: 00007FFDA3674B00

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: String$Bytes_Err_FromO_ctrlSize
String ID: Not a memory BIO
API String ID: 2349510700-587638661
Opcode ID: 614c871b5d69d04367f3485d5a2068cd9391e9c87421409b60ef2095a56860c2
Instruction ID: 36de7ecd5e78715a41a09ee1ed80c92456ac34689b185fbc981984fda1c75456
Opcode Fuzzy Hash: 614c871b5d69d04367f3485d5a2068cd9391e9c87421409b60ef2095a56860c2
Instruction Fuzzy Hash: 91F05461B2B54282FB44DF61E4A97752362FF88B84F886031D94E56715CF7EE0488B04

Function 00007FFDA354B530 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354B5DA
PyErr_NoMemory.PYTHON313 ref: 00007FFDA354B5EB
PyMem_Free.PYTHON313 ref: 00007FFDA354B673
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA354B686

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_FreeMem_Memoryfreemalloc
String ID:
API String ID: 182096997-0
Opcode ID: 5a0dd487b60a1102b4735315523d65cbd22cac1ecefffe0ac02d4da6dfbaffd5
Instruction ID: 49f83f5d04abc805f23aa29d845e18f449a5ef4bad9869892f770460651256ed
Opcode Fuzzy Hash: 5a0dd487b60a1102b4735315523d65cbd22cac1ecefffe0ac02d4da6dfbaffd5
Instruction Fuzzy Hash: CE41EE73B06A5186DF169F58D0102B9B7A2FB94BE4F484231DE9C23795EF3AE4458344

Function 00007FFDA3544B30 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3544B61
memset.VCRUNTIME140 ref: 00007FFDA3544B73
memset.VCRUNTIME140 ref: 00007FFDA3544B9E
_Py_NewReference.PYTHON313 ref: 00007FFDA3544BB2

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: memset$Referencemalloc
String ID:
API String ID: 3353409452-0
Opcode ID: 702a331324a4662ae84315dbd7bb521fc5055dc9d41250d5f85af3e01e8bffa1
Instruction ID: ddc89157d8b39575b367c5b8835e2cbcdb729494ab62234a1c18cda764ca841f
Opcode Fuzzy Hash: 702a331324a4662ae84315dbd7bb521fc5055dc9d41250d5f85af3e01e8bffa1
Instruction Fuzzy Hash: 31113C22B19B4497D720CF6AF49005AB771FB98B80B455039DB9E83B25EF7DE051C748

Function 00007FFDA3549080 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

_Py_NewReference.PYTHON313 ref: 00007FFDA35490D5
GetLengthSid.ADVAPI32 ref: 00007FFDA35490DE
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35490E8
CopySid.ADVAPI32 ref: 00007FFDA35490FA

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: CopyLengthReferencemalloc
String ID:
API String ID: 3624451276-0
Opcode ID: eb9076c558b8a3fd92a970d114becebbb9b8943ef10aafd25703f05eb12ffbd7
Instruction ID: 0d73cdbef2290472638a5026b7d80ec856763fe4c3689efab6c5f1f6729fd9b1
Opcode Fuzzy Hash: eb9076c558b8a3fd92a970d114becebbb9b8943ef10aafd25703f05eb12ffbd7
Instruction Fuzzy Hash: 40018031F0AB4182EF499B5AF96416963A6FF49BD0F044034DA4E13B66DF3EE5518708

Function 00007FFD94434F54 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFD94434F80
GetCurrentThreadId.KERNEL32 ref: 00007FFD94434F8E
GetCurrentProcessId.KERNEL32 ref: 00007FFD94434F9A
QueryPerformanceCounter.KERNEL32 ref: 00007FFD94434FAA

Memory Dump Source

Source File: 00000002.00000002.3411868379.00007FFD94271000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFD94270000, based on PE: true

Associated: 00000002.00000002.3411850911.00007FFD94270000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412055684.00007FFD94525000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412055684.00007FFD94546000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412055684.00007FFD94555000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412055684.00007FFD9455F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412055684.00007FFD945A1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412055684.00007FFD94670000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412055684.00007FFD94678000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412337694.00007FFD9477F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412359134.00007FFD94796000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412377850.00007FFD9479B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412396889.00007FFD9479C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412418207.00007FFD9479D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412440227.00007FFD9479E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412470912.00007FFD947C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412491849.00007FFD947C6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412510288.00007FFD947CE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412541529.00007FFD9480F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412577150.00007FFD94843000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412620155.00007FFD9486B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412641905.00007FFD9486D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412662715.00007FFD9486F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412684080.00007FFD94870000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412703956.00007FFD94871000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412726168.00007FFD94873000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412749382.00007FFD94882000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3412791318.00007FFD948B0000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd94270000_user.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: fe63b84064a5ce4d74b8ca480f490018c065660e782260b98ef3b250c9bc7566
Instruction ID: c4ee2883eb677cf44d24125b514b9221392e6536c844c2a176e675c441bc95c0
Opcode Fuzzy Hash: fe63b84064a5ce4d74b8ca480f490018c065660e782260b98ef3b250c9bc7566
Instruction Fuzzy Hash: 6F111C26B14B058AEB50DFA0E8A42B833A4F71A758F845E31EA6D867A5DF7CD154C380

Function 00007FFDA3672F60 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDA3672F8C
GetCurrentThreadId.KERNEL32 ref: 00007FFDA3672F9A
GetCurrentProcessId.KERNEL32 ref: 00007FFDA3672FA6
QueryPerformanceCounter.KERNEL32 ref: 00007FFDA3672FB6

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 76cc7d293dce52ac903e1c4f27db05cd87f84480e9050da05d46ae017720b8e1
Instruction ID: 3b8139c18caf596e4004d223cfd62573713d058389f967b63c8835cadd0ce859
Opcode Fuzzy Hash: 76cc7d293dce52ac903e1c4f27db05cd87f84480e9050da05d46ae017720b8e1
Instruction Fuzzy Hash: 54111C22B15B058AFB008F71E8642B833A4FB19758F481E31DA6D567A5DF79D1688344

Function 00007FFDA3544AA0 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3544AC4
memset.VCRUNTIME140 ref: 00007FFDA3544AD6
memset.VCRUNTIME140 ref: 00007FFDA3544AF9
_Py_NewReference.PYTHON313 ref: 00007FFDA3544B09

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: memset$Referencemalloc
String ID:
API String ID: 3353409452-0
Opcode ID: bbf950d98bc3cd11b916acf723f5275b2f468ca755442ab4f61e8457fbf862c0
Instruction ID: c2c92f73585215298aec5dc6e82e59a4b05cf5969136e80b26f427c49a021901
Opcode Fuzzy Hash: bbf950d98bc3cd11b916acf723f5275b2f468ca755442ab4f61e8457fbf862c0
Instruction Fuzzy Hash: 20016D22B15B5592EB04CF2AE45002D7762FF88F84B095039EE1D53729EF3AD452C788

Function 00007FFDA35494D0 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

_Py_NewReference.PYTHON313 ref: 00007FFDA35494F3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35494FC
memset.VCRUNTIME140 ref: 00007FFDA3549513
memcpy.VCRUNTIME140 ref: 00007FFDA354952E

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Referencemallocmemcpymemset
String ID:
API String ID: 1282408338-0
Opcode ID: 73095b53417423003ff8c3720ff8871ddab7b9a8b5b7f12efa74452b125d15c7
Instruction ID: dbf2cd636c481f5dec495a21f929db5a252749aa0da90af60581c5d77b2ab31c
Opcode Fuzzy Hash: 73095b53417423003ff8c3720ff8871ddab7b9a8b5b7f12efa74452b125d15c7
Instruction Fuzzy Hash: ECF04421F1AB8181EB459B1AF850069A765EF48FD0F488034EE5D13F1ADF3DD5928704

Function 00007FFDA35443C0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

_Py_NewReference.PYTHON313 ref: 00007FFDA35443E8
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35443F1
memset.VCRUNTIME140 ref: 00007FFDA3544403
InitializeAcl.ADVAPI32 ref: 00007FFDA3544411

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: InitializeReferencemallocmemset
String ID:
API String ID: 306314696-0
Opcode ID: 8eaef662fe11b7ed3f416aa89d04ef063d77837210d100f2d8329317cefc0958
Instruction ID: fdc032f6911df4fd7705111b0bf46417cb293844f888c9c110153f9fa57c5c00
Opcode Fuzzy Hash: 8eaef662fe11b7ed3f416aa89d04ef063d77837210d100f2d8329317cefc0958
Instruction Fuzzy Hash: 72F04F22B09F9186D700DB16F850059B765FB88FD0F544035EE5E53B2ADF3DD5928748

Function 00007FFDA3548B60 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

_Py_NewReference.PYTHON313 ref: 00007FFDA3548B7B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3548B8D
InitializeSecurityDescriptor.ADVAPI32 ref: 00007FFDA3548BA6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3548BBE

Part of subcall function 00007FFDA3547D20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D3B
Part of subcall function 00007FFDA3547D20: GetSecurityDescriptorLength.ADVAPI32(?,?,?,00007FFDA3541931), ref: 00007FFDA3547D44

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: DescriptorSecurityfree$InitializeLengthReferencemalloc
String ID:
API String ID: 2992339461-0
Opcode ID: 3885bea4552c8b6a4a56223f5b7daa316118e0659c06125b2451a4d2c74a1f0f
Instruction ID: ae777c5e3d47f2870d9c9c73b27beab1982ba0184f5ec999c5077211c0ab1d4e
Opcode Fuzzy Hash: 3885bea4552c8b6a4a56223f5b7daa316118e0659c06125b2451a4d2c74a1f0f
Instruction Fuzzy Hash: 24F09021F0AB0682EF099B16F96433962A2AB48FC0F088034CD5F0BB56CF7EE5958304

Function 00007FFDA3549550 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

_Py_NewReference.PYTHON313 ref: 00007FFDA3549570
GetLengthSid.ADVAPI32 ref: 00007FFDA3549579
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3549583
CopySid.ADVAPI32 ref: 00007FFDA3549595

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: CopyLengthReferencemalloc
String ID:
API String ID: 3624451276-0
Opcode ID: a89472044513ba651987c9a091f99ce9793c8cbcf630952da96ca9784dc25113
Instruction ID: a1614792b2dd7079861c8d2e22d00dee393bf8a28038066a682b406f737a2dd1
Opcode Fuzzy Hash: a89472044513ba651987c9a091f99ce9793c8cbcf630952da96ca9784dc25113
Instruction Fuzzy Hash: 35F05E21F1AB8182DB108B5AF85402AA7A6FB48FC0B044034DA4E53B29DF3DE5918704

Function 00007FFDA3674844 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

X509_STORE_lock.LIBCRYPTO-3 ref: 00007FFDA3674851
X509_STORE_get0_objects.LIBCRYPTO-3 ref: 00007FFDA3674862
OPENSSL_sk_deep_copy.LIBCRYPTO-3 ref: 00007FFDA3674879
X509_STORE_unlock.LIBCRYPTO-3 ref: 00007FFDA3674885

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: X509_$E_get0_objectsE_lockE_unlockL_sk_deep_copy
String ID:
API String ID: 1564091015-0
Opcode ID: 83532caa02f6acb35b1453e7cc456119fdfb91cd1ecb4dc9de09abdf9df6df6a
Instruction ID: 2559e5a540425e91381b5dfaf5afcca3f6b47829776aafb232cedf6536884a2a
Opcode Fuzzy Hash: 83532caa02f6acb35b1453e7cc456119fdfb91cd1ecb4dc9de09abdf9df6df6a
Instruction Fuzzy Hash: D2F06C10F1A74781FA144B52B9684745356AF49FD0F8C2035DD1E57316DF3EE0888308

Function 00007FFDA354C1C0 Relevance: 6.0, APIs: 4, Instructions: 20threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FFDA354C1CC
PyThreadState_Delete.PYTHON313 ref: 00007FFDA354C1E3
TlsSetValue.KERNEL32 ref: 00007FFDA354C1F1
LocalFree.KERNEL32 ref: 00007FFDA354C1FA

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Value$DeleteFreeLocalState_Thread
String ID:
API String ID: 3706641815-0
Opcode ID: 8a2e063ff86a224c7f4f91bb71c4a4de6d4722a2c61b2448b33797f2fe0f29d8
Instruction ID: b37f36bdf5f31e8e91d83e900335539424deaa10e1bc3ebb20ade026f65c6b5e
Opcode Fuzzy Hash: 8a2e063ff86a224c7f4f91bb71c4a4de6d4722a2c61b2448b33797f2fe0f29d8
Instruction Fuzzy Hash: 39F03024F0A70282FB0A8B69E86473422A3AF88705F084034C90F163A2CF3EB594C608

Function 00007FFDA354A400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA3549AB0: PyImport_ImportModule.PYTHON313 ref: 00007FFDA3549AD1
Part of subcall function 00007FFDA3549AB0: PyObject_GetAttrString.PYTHON313 ref: 00007FFDA3549AED
Part of subcall function 00007FFDA3549AB0: _Py_Dealloc.PYTHON313 ref: 00007FFDA3549B04
Part of subcall function 00007FFDA3549AB0: PyTuple_New.PYTHON313 ref: 00007FFDA3549B11
Part of subcall function 00007FFDA3549AB0: PyObject_CallMethod.PYTHON313 ref: 00007FFDA3549B30
Part of subcall function 00007FFDA3549AB0: _Py_Dealloc.PYTHON313 ref: 00007FFDA3549B4B
Part of subcall function 00007FFDA3549AB0: _Py_Dealloc.PYTHON313 ref: 00007FFDA3549B66

PyObject_GetAttrString.PYTHON313(?,?,?,?,?,?,?,?,?,00007FFDA3549C6D), ref: 00007FFDA354A444
_Py_Dealloc.PYTHON313(?,?,?,?,?,?,?,?,?,00007FFDA3549C6D), ref: 00007FFDA354A4A8

Strings

max, xrefs: 00007FFDA354A439

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Dealloc$Object_$AttrString$CallImportImport_MethodModuleTuple_
String ID: max
API String ID: 66079785-2641765001
Opcode ID: c7742cccba0b74eac24001ffb7e123acc52cb9acd810040e86681d1a68a09f60
Instruction ID: 39679efc65c4652eec518bae3b58e4039542b8f5d92596080dcccabbc1d88a89
Opcode Fuzzy Hash: c7742cccba0b74eac24001ffb7e123acc52cb9acd810040e86681d1a68a09f60
Instruction Fuzzy Hash: 8E118E32A0979282DB564F1AF15103DB3A2FB44B80F044031EA9D57B99DF3DE5A0C704

Function 00007FFDA36773C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

PyArg_Parse.PYTHON313 ref: 00007FFDA3677412
PyMem_Free.PYTHON313 ref: 00007FFDA3677461

Strings

ascii, xrefs: 00007FFDA3677404

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Arg_FreeMem_Parse
String ID: ascii
API String ID: 1432672584-3510295289
Opcode ID: 243e4b09a69d811b6d5c2e9971f28d01f14bfb2967ed676d6493a3d16c9a3df8
Instruction ID: 9b8ebf4626d8b9c19e1ebd8d1300f21a68e5013437ec335ca7742d224266f5cc
Opcode Fuzzy Hash: 243e4b09a69d811b6d5c2e9971f28d01f14bfb2967ed676d6493a3d16c9a3df8
Instruction Fuzzy Hash: 95113A32B09B8182EA50CF12E890169B7A5FB88F80F585136EF8C93B29DF3DD1558B04

Function 00007FFDA3549BE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3549C02

Part of subcall function 00007FFDA3546460: PyLong_AsLongLong.PYTHON313 ref: 00007FFDA3546485
Part of subcall function 00007FFDA3546460: PyErr_Occurred.PYTHON313 ref: 00007FFDA3546494

FileTimeToSystemTime.KERNEL32 ref: 00007FFDA3549C39

Part of subcall function 00007FFDA354C400: GetLastError.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C41B
Part of subcall function 00007FFDA354C400: FormatMessageW.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C48A
Part of subcall function 00007FFDA354C400: PyUnicode_DecodeMBCS.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C568
Part of subcall function 00007FFDA354C400: Py_BuildValue.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C57D
Part of subcall function 00007FFDA354C400: LocalFree.KERNEL32(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C595
Part of subcall function 00007FFDA354C400: PyErr_SetObject.PYTHON313(?,?,?,?,?,00000000,00000000,00007FFDA3547A4D,?,?,00000000,00007FFDA3547DC2,?,?,?,00007FFDA3541931), ref: 00007FFDA354C5AA

Strings

FileTimeToSystemTime, xrefs: 00007FFDA3549C45

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_LongTime$Arg_BuildDecodeErrorFileFormatFreeLastLocalLong_MessageObjectOccurredParseSystemTupleUnicode_Value
String ID: FileTimeToSystemTime
API String ID: 1618908028-1754531670
Opcode ID: 99e37812b2323da1d358adf734d79309d4d6e63afb47562442355d7a361db807
Instruction ID: 939dd17fbd3a16b36caf189c8992c30142d81608d1da0ce295f53fa80ddc15a2
Opcode Fuzzy Hash: 99e37812b2323da1d358adf734d79309d4d6e63afb47562442355d7a361db807
Instruction Fuzzy Hash: 2611B961F1998282EF56EB19E46206A73A3FFC4744F844031E54E52757EE2DE5058B04

Function 00007FFDA3543360 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA35433A0

Strings

AddAccessDeniedObjectAce, xrefs: 00007FFDA35433B7
lllOOO:AddAccessDeniedObjectAce, xrefs: 00007FFDA3543386

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddAccessDeniedObjectAce$lllOOO:AddAccessDeniedObjectAce
API String ID: 3371842430-3179976129
Opcode ID: e3dfeb46af7c84d4519f2e145db967f80bf3f2d84102a64a761ca55c8579d974
Instruction ID: 4ab9bf493938968aab3c89cc638b378452b39e96dff33a683611f0a31d5308e4
Opcode Fuzzy Hash: e3dfeb46af7c84d4519f2e145db967f80bf3f2d84102a64a761ca55c8579d974
Instruction Fuzzy Hash: D1119A72B09B8582CF11CF55F4844AD73A1FB88790F110136EAAD87B25EF3AD998CB00

Function 00007FFDA35432B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA35432F0

Strings

lllOOO:AddAccessAllowedObjectAce, xrefs: 00007FFDA35432D6
AddAccessAllowedObjectAce, xrefs: 00007FFDA3543307

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddAccessAllowedObjectAce$lllOOO:AddAccessAllowedObjectAce
API String ID: 3371842430-684429688
Opcode ID: d8f714f13fb6f6a21b8a46a53381e791b01951d00187e0f0dc706bbcebc28b78
Instruction ID: 650267201a98d46af89ec0d7d11e080ae5e3686e732084e330a69031bf79855f
Opcode Fuzzy Hash: d8f714f13fb6f6a21b8a46a53381e791b01951d00187e0f0dc706bbcebc28b78
Instruction Fuzzy Hash: 67119A72B09B8582CF11CF55F4844AD73A1F788790F110136EAAD83B25EF3AD998CB00

Function 00007FFDA3679730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON313 ref: 00007FFDA367976D
PyObject_IsTrue.PYTHON313 ref: 00007FFDA3679780

Strings

getpeercert, xrefs: 00007FFDA3679766

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Arg_CheckObject_PositionalTrue
String ID: getpeercert
API String ID: 341638686-200429401
Opcode ID: a31f197caa86e27ec99a35df48cb99ec636af6543adc5f2850ac52fd4abccb1b
Instruction ID: 9a14916663ebb2ef0fad15915cf58d9ecf6fa4044c2da47a53c6861ab78b26a0
Opcode Fuzzy Hash: a31f197caa86e27ec99a35df48cb99ec636af6543adc5f2850ac52fd4abccb1b
Instruction Fuzzy Hash: 11018F36B09B518AF7509F16A8640A977E6FB88FC0B9D6035DE0DA7716CF3AE841C704

Function 00007FFDA3542FA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3542FD4

Strings

kkkO:AddMandatoryAce, xrefs: 00007FFDA3542FCA
AddMandatoryAce, xrefs: 00007FFDA3542FEB

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddMandatoryAce$kkkO:AddMandatoryAce
API String ID: 3371842430-3675006617
Opcode ID: 4b493b86a8402f20ddd570d78824f01e47810dec285230cae9a0e7602c506f2d
Instruction ID: 3f34454694f4e8d372c27975f52d509a6067f4d1564f02c90a1de70b73f85df3
Opcode Fuzzy Hash: 4b493b86a8402f20ddd570d78824f01e47810dec285230cae9a0e7602c506f2d
Instruction Fuzzy Hash: D1011A76B09741D2EB11CB68F4504AA77A1FB88794B540222EB8D93B29DF3DD294CF04

Function 00007FFDA3542E80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3542EB4

Strings

lllO:AddAccessAllowedAceEx, xrefs: 00007FFDA3542EAA
AddAccessAllowedAceEx, xrefs: 00007FFDA3542ECB

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddAccessAllowedAceEx$lllO:AddAccessAllowedAceEx
API String ID: 3371842430-1263352432
Opcode ID: 8ed8396cbea493bc20a4220841801d33528b5f207fb43b7afe4ccf89f4662698
Instruction ID: cf6c688cc09f7f6b7f077e52528ea5567e266513e13ecc4e429e1d4e5c7e03d7
Opcode Fuzzy Hash: 8ed8396cbea493bc20a4220841801d33528b5f207fb43b7afe4ccf89f4662698
Instruction Fuzzy Hash: D6012C76B09741D2EB11CB69F4500AA77A1FB88794B540222EB8D93B29DF3DD294CF04

Function 00007FFDA3542F10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3542F44

Strings

AddAccessDeniedAceEx, xrefs: 00007FFDA3542F5B
lllO:AddAccessDeniedAceEx, xrefs: 00007FFDA3542F3A

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddAccessDeniedAceEx$lllO:AddAccessDeniedAceEx
API String ID: 3371842430-4150984663
Opcode ID: de81793985394db8eda63548ea9406e6c785a4610c77cab919a9f42de7ceaeda
Instruction ID: dd996924bb2963b5f41fa12e77ac8c3d8fd64871c995f8429fd0eefdcd4a27b9
Opcode Fuzzy Hash: de81793985394db8eda63548ea9406e6c785a4610c77cab919a9f42de7ceaeda
Instruction Fuzzy Hash: 95017176B09741D2DB11CB68F0500AA77A1FB88780F540222EB8C93B25DF3DD154CF04

Function 00007FFDA35466F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA35466FE
_Py_NewReference.PYTHON313 ref: 00007FFDA3546743

Strings

:OVERLAPPED, xrefs: 00007FFDA35466F7

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseReferenceTuple
String ID: :OVERLAPPED
API String ID: 709158290-1552635527
Opcode ID: 99eac4c21a0de1c82c8a4d1f398764541f69fd89d1bf1e656bce4408f3be1879
Instruction ID: 5fad088cc750bcf7582c6cf2e935523075dd619960da0348bae1491669f2df6d
Opcode Fuzzy Hash: 99eac4c21a0de1c82c8a4d1f398764541f69fd89d1bf1e656bce4408f3be1879
Instruction Fuzzy Hash: CE01B132E15B8182D7048F25E99016D73EAFB99B84F545235DA8D53715EF3CE1E0C704

Function 00007FFDA354D4F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PySequence_Tuple.PYTHON313(?,?,?,00007FFDA354CDCB), ref: 00007FFDA354D4F9
_Py_Dealloc.PYTHON313(?,?,?,00007FFDA354CDCB), ref: 00007FFDA354D52B

Strings

Sequence can contain at most %d items, xrefs: 00007FFDA354D538

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: DeallocSequence_Tuple
String ID: Sequence can contain at most %d items
API String ID: 1991852567-3507602910
Opcode ID: ba9606983f3295d13d172f3df34be46ad0d38ebee954a0bfa1b3dec53b8fac5d
Instruction ID: d387b35001ad01dcaf014342912a2b5f55054846e9f7491cec2e653e1a74ca80
Opcode Fuzzy Hash: ba9606983f3295d13d172f3df34be46ad0d38ebee954a0bfa1b3dec53b8fac5d
Instruction Fuzzy Hash: 69F06D62F1BB4282EF1A8B19E46057423A2EB88B94F081031CD1E13796DE3EE5808B08

Function 00007FFDA354CFA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA354AD90: PyErr_SetString.PYTHON313 ref: 00007FFDA354ADCF

PyErr_Clear.PYTHON313 ref: 00007FFDA354CFBC

Part of subcall function 00007FFDA354CEB0: PyNumber_Long.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEC5
Part of subcall function 00007FFDA354CEB0: PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CED3
Part of subcall function 00007FFDA354CEB0: PyLong_AsLongLong.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEE1
Part of subcall function 00007FFDA354CEB0: PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEF0
Part of subcall function 00007FFDA354CEB0: PyErr_Clear.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEFB
Part of subcall function 00007FFDA354CEB0: PyLong_AsUnsignedLongLong.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF04
Part of subcall function 00007FFDA354CEB0: PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF13
Part of subcall function 00007FFDA354CEB0: _Py_Dealloc.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF2C
Part of subcall function 00007FFDA354CEB0: PyErr_Format.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF4B

PyErr_SetString.PYTHON313 ref: 00007FFDA354CFF2

Strings

Resource id/name must be string or int in the range 0-65536, xrefs: 00007FFDA354CFE1

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$Long$Occurred$ClearLong_String$DeallocFormatNumber_Unsigned
String ID: Resource id/name must be string or int in the range 0-65536
API String ID: 286819204-907244015
Opcode ID: 31b1ca96400902001310dfbad8b15d17db623f0623437432e6c4c09ff0a382c6
Instruction ID: 6622b1c5fe9d34d348c351c582141c704965e61e93793d22005b26a4835035ab
Opcode Fuzzy Hash: 31b1ca96400902001310dfbad8b15d17db623f0623437432e6c4c09ff0a382c6
Instruction Fuzzy Hash: 5CF04F21F1974291EB569B6AF9683791293EB88BC4F444031DA0E97756EE3EE4818708

Function 00007FFDA354D040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA354B1A0: PyUnicode_AsWideCharString.PYTHON313 ref: 00007FFDA354B1DA
Part of subcall function 00007FFDA354B1A0: PyErr_SetString.PYTHON313 ref: 00007FFDA354B1F9

PyErr_Clear.PYTHON313 ref: 00007FFDA354D05C

Part of subcall function 00007FFDA354CEB0: PyNumber_Long.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEC5
Part of subcall function 00007FFDA354CEB0: PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CED3
Part of subcall function 00007FFDA354CEB0: PyLong_AsLongLong.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEE1
Part of subcall function 00007FFDA354CEB0: PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEF0
Part of subcall function 00007FFDA354CEB0: PyErr_Clear.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CEFB
Part of subcall function 00007FFDA354CEB0: PyLong_AsUnsignedLongLong.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF04
Part of subcall function 00007FFDA354CEB0: PyErr_Occurred.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF13
Part of subcall function 00007FFDA354CEB0: _Py_Dealloc.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF2C
Part of subcall function 00007FFDA354CEB0: PyErr_Format.PYTHON313(?,?,?,00007FFDA35450DE), ref: 00007FFDA354CF4B

PyErr_SetString.PYTHON313 ref: 00007FFDA354D092

Strings

Resource id/name must be unicode or int in the range 0-65536, xrefs: 00007FFDA354D081

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_$Long$OccurredString$ClearLong_$CharDeallocFormatNumber_Unicode_UnsignedWide
String ID: Resource id/name must be unicode or int in the range 0-65536
API String ID: 293670993-4091729669
Opcode ID: 555b23e77155b6422bb856a96e125e404c24bcfd3c1006e6b91ad9e20b969513
Instruction ID: 90e52b1b4a2bfaeec56c05e599ed5c925bfcae59a5c5fc997596b71464f636a8
Opcode Fuzzy Hash: 555b23e77155b6422bb856a96e125e404c24bcfd3c1006e6b91ad9e20b969513
Instruction Fuzzy Hash: 68F0A471F1A74281FF569B2AF5683791293AB48BC4F444031DA0E97747EE3EE0818708

Function 00007FFDA354A820 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PyCapsule_Import.PYTHON313 ref: 00007FFDA354A82D
PyType_Ready.PYTHON313 ref: 00007FFDA354A881

Strings

datetime.datetime_CAPI, xrefs: 00007FFDA354A826

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Capsule_ImportReadyType_
String ID: datetime.datetime_CAPI
API String ID: 2581296196-711417590
Opcode ID: 71f6e2cd8b549125eda3018e95e8dee2b3e503f95c455a05ccb1b3c9eda9d859
Instruction ID: de021d9e202dc8b3b3520e7b9e17e16d9c3e304e09fd7768d6fa2a9b8cc7c3e0
Opcode Fuzzy Hash: 71f6e2cd8b549125eda3018e95e8dee2b3e503f95c455a05ccb1b3c9eda9d859
Instruction Fuzzy Hash: BC01EC75F06B4181EA06CB1EE8A007437A6FB88B90F498531C95E93361DF3EE5A6C304

Function 00007FFDA3545340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3545356
PyLong_FromLongLong.PYTHON313 ref: 00007FFDA3545380

Strings

:Detach, xrefs: 00007FFDA354534F

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Long$Arg_FromLong_ParseTuple
String ID: :Detach
API String ID: 1152936543-4103459575
Opcode ID: f8836bdbb5d1f36a60bbf496dee83d82e6e9fc9586328ff7cf63e7ebb02f3342
Instruction ID: 32c56ec82d7163d948f289c9c8ce7e18ad4bb09822d158d84147ac03e183bd63
Opcode Fuzzy Hash: f8836bdbb5d1f36a60bbf496dee83d82e6e9fc9586328ff7cf63e7ebb02f3342
Instruction Fuzzy Hash: 54F0A721B1574182EF564F29F95036922E2BF48BC0F885434D91E87745FF7DE594C704

Function 00007FFDA354BA40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA354BA4E
_Py_NewReference.PYTHON313 ref: 00007FFDA354BA84

Strings

:WAVEFORMATEX, xrefs: 00007FFDA354BA47

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseReferenceTuple
String ID: :WAVEFORMATEX
API String ID: 709158290-1364142124
Opcode ID: 669a32538ec6f923bfe1ee86a65c60c36bc7eb7b96e35d950023d8bde529439e
Instruction ID: 518dc5ca64641d49b24f3c976b81fa8f4edf936edf96bb3d55f32f4d5e198796
Opcode Fuzzy Hash: 669a32538ec6f923bfe1ee86a65c60c36bc7eb7b96e35d950023d8bde529439e
Instruction Fuzzy Hash: 34F0B421F1674282DB15CF36EC5006932A2FF8DB44F845235D64E93312EF3DE2A08708

Function 00007FFDA367BE68 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SSL_CTX_get_verify_mode.LIBSSL-3 ref: 00007FFDA367BE75
PyErr_SetString.PYTHON313 ref: 00007FFDA367BE9D

Strings

invalid return value from SSL_CTX_get_verify_mode, xrefs: 00007FFDA367BE92

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Err_StringX_get_verify_mode
String ID: invalid return value from SSL_CTX_get_verify_mode
API String ID: 3939857436-2501269723
Opcode ID: 37755f1760e9c2ebd58fc1c0ff21f95e39aa076c3fd6608a9ad303eb35dd497f
Instruction ID: b868440d931845dff6e41c7af143318fbf4f85cc78516cc5bf7c5143e2551701
Opcode Fuzzy Hash: 37755f1760e9c2ebd58fc1c0ff21f95e39aa076c3fd6608a9ad303eb35dd497f
Instruction Fuzzy Hash: 74F01222B2A54682FB298725D8B51751372EB48B54F9C2435C61E9B3A1CF2ED8D6C308

Function 00007FFDA36767A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA36767C9
SSL_CTX_set_verify.LIBSSL-3 ref: 00007FFDA36767E9

Strings

invalid value for verify_mode, xrefs: 00007FFDA36767BF

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Err_StringX_set_verify
String ID: invalid value for verify_mode
API String ID: 4223523404-2668209411
Opcode ID: 6ea304071ca4d8d0a79c7e74895354ef27ed3270ac4b79d11357d5cbf65ca215
Instruction ID: 6dcbefa79a2a362636f453a66e625f05b397e53b79883bd19f7ea27649c2f3e9
Opcode Fuzzy Hash: 6ea304071ca4d8d0a79c7e74895354ef27ed3270ac4b79d11357d5cbf65ca215
Instruction Fuzzy Hash: 01F0A734F0A44741FA518728C87C1B41393BF88B84FE86431C80D96795DF2FE5498304

Function 00007FFDA3549A60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON313 ref: 00007FFDA3549A7D
PyObject_HasAttrString.PYTHON313 ref: 00007FFDA3549A91

Strings

timetuple, xrefs: 00007FFDA3549A87

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: AttrObject_StringSubtypeType_
String ID: timetuple
API String ID: 1421930220-3328721318
Opcode ID: 3f8d4b43d52be91b307c0cdd37ca4129189ec392190273ab2ef4856b4f036eae
Instruction ID: dc4544a502284e9a467d065ab33118d848fdec2c1743790fcbaaa763f53ad52b
Opcode Fuzzy Hash: 3f8d4b43d52be91b307c0cdd37ca4129189ec392190273ab2ef4856b4f036eae
Instruction Fuzzy Hash: BCE0ED91F4660282FF1A8B5FE8A653513939F58B91F489030CD1D56752EF1FE9D18308

Function 00007FFDA3541A70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3541A98

Strings

@, xrefs: 00007FFDA3541A77
|ii:ACL, xrefs: 00007FFDA3541A7F

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: @$|ii:ACL
API String ID: 3371842430-2672190651
Opcode ID: a334b7dfaa821d41b7e8f3be6c7a66ccbd714a8d02a99bdf497d0802bf0223a7
Instruction ID: 597c4e7dbee73c9353f7ea806f0663bca84074f99455e2999874cb68ad80ff1f
Opcode Fuzzy Hash: a334b7dfaa821d41b7e8f3be6c7a66ccbd714a8d02a99bdf497d0802bf0223a7
Instruction Fuzzy Hash: 4CF0A775F096C182E604DB95F411259A7A2FBC47A4FC04034EA4D53756DFBCD109CF04

Function 00007FFDA367CAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA367CAC3
PyObject_IsTrue.PYTHON313 ref: 00007FFDA367CAD1

Strings

cannot delete attribute, xrefs: 00007FFDA367CAB9

Memory Dump Source

Source File: 00000002.00000002.3413314326.00007FFDA3671000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3670000, based on PE: true

Associated: 00000002.00000002.3413296727.00007FFDA3670000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413333595.00007FFDA367E000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413356696.00007FFDA3691000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413376557.00007FFDA3692000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413396390.00007FFDA3698000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000002.00000002.3413414339.00007FFDA369A000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3670000_user.jbxd

Similarity

API ID: Err_Object_StringTrue
String ID: cannot delete attribute
API String ID: 1323943456-1747274469
Opcode ID: 8c84c338d224894d3ed47382b29769635c97ffba318e277e14ad243b3d061bae
Instruction ID: be0388e6f8c85ba81becc95cfc908470ef1e5466b3644a770a70d93308f38ffb
Opcode Fuzzy Hash: 8c84c338d224894d3ed47382b29769635c97ffba318e277e14ad243b3d061bae
Instruction Fuzzy Hash: 57E01265B0650281FA24CB7598A40342363AF54B69B9C6B31C92EAA3D6EF6E94898704

Function 00007FFDA3541BA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3541BB6
IsValidAcl.ADVAPI32 ref: 00007FFDA3541BCC

Strings

:IsValid, xrefs: 00007FFDA3541BAF

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseTupleValid
String ID: :IsValid
API String ID: 2541654197-2800628479
Opcode ID: c205e6c6629add5205025c12b4e55ecd6f97f98ddf72bd804bbb35d485ae357b
Instruction ID: 11dc802bb6ef1701805009c2b21d490f0a6437584f84c87ddb99e8117bbf1ee1
Opcode Fuzzy Hash: c205e6c6629add5205025c12b4e55ecd6f97f98ddf72bd804bbb35d485ae357b
Instruction Fuzzy Hash: B1E08C11F1AA0682EF0A8BBAEC6007512E2AF48B80B041030CD0F96362FE2DF6D18708

Function 00007FFDA35492C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA35492D6
GetLengthSid.ADVAPI32 ref: 00007FFDA35492EC

Strings

:GetLength, xrefs: 00007FFDA35492CF

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_LengthParseTuple
String ID: :GetLength
API String ID: 1894485733-295138441
Opcode ID: 3c69dd88cdf965b284251de54f93c677440366d6c9c987ed12ccb91b8556208d
Instruction ID: 1e8e1d172b905fae800b5ee957fe460b5e8c2f4f07c3f3e04147d05dc0e9bc20
Opcode Fuzzy Hash: 3c69dd88cdf965b284251de54f93c677440366d6c9c987ed12ccb91b8556208d
Instruction Fuzzy Hash: B0E0CD51F1B60282EF1A4B76EC610751292EF48B80B041430CD1F96361EE2DF5D1C708

Function 00007FFDA3548AC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3548AD6
GetSecurityDescriptorLength.ADVAPI32 ref: 00007FFDA3548AEC

Strings

:GetLength, xrefs: 00007FFDA3548ACF

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_DescriptorLengthParseSecurityTuple
String ID: :GetLength
API String ID: 840013968-295138441
Opcode ID: 4b502b493f44923badd855b2eabefab93c9aa0276462f2218449576b2ef85afb
Instruction ID: 2247dfc526670aa2db5a1bab42d03410c2b58a7a2ffc90337151c62f448054ed
Opcode Fuzzy Hash: 4b502b493f44923badd855b2eabefab93c9aa0276462f2218449576b2ef85afb
Instruction Fuzzy Hash: D6E08C51F1AA4282EF0A4BBAEC600751292AF48B90B041431CD1F96362EE6DF6E68708

Function 00007FFDA3548A80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3548A96
IsValidSecurityDescriptor.ADVAPI32 ref: 00007FFDA3548AAC

Strings

:IsValid, xrefs: 00007FFDA3548A8F

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_DescriptorParseSecurityTupleValid
String ID: :IsValid
API String ID: 1292091245-2800628479
Opcode ID: 62955e74c7143c37824a64132e3129fc9fe357e4491e50685c69f37ce866d45b
Instruction ID: 915bda25d012aa89d8f21e8cadae7b406b9b856a813a54c4a63499743911c791
Opcode Fuzzy Hash: 62955e74c7143c37824a64132e3129fc9fe357e4491e50685c69f37ce866d45b
Instruction Fuzzy Hash: 57E0E651F1A60682EF1A5B66EC6007512969F48B90F041431CD1F96761ED7DF5D58704

Function 00007FFDA3549300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3549316
GetSidSubAuthorityCount.ADVAPI32 ref: 00007FFDA354932C

Strings

:GetSubAuthorityCount, xrefs: 00007FFDA354930F

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_AuthorityCountParseTuple
String ID: :GetSubAuthorityCount
API String ID: 4231099721-2020981275
Opcode ID: da784ef745ded8b10977a995322f8d6846b7cc8515693475c2a544ad34ee81bc
Instruction ID: af23e3d82d928d04f1e5d077e77f007b82c331e33b0eef2fb1160edc8536fe99
Opcode Fuzzy Hash: da784ef745ded8b10977a995322f8d6846b7cc8515693475c2a544ad34ee81bc
Instruction Fuzzy Hash: A4E08651F0B64282EF0A4B7AEC6107426A29F48B81B445430CD1F96352EE2DF6E18704

Function 00007FFDA3549200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDA3549216
IsValidSid.ADVAPI32 ref: 00007FFDA354922C

Strings

:IsValid, xrefs: 00007FFDA354920F

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Arg_ParseTupleValid
String ID: :IsValid
API String ID: 2541654197-2800628479
Opcode ID: 0b4349dba64da8df61b8a50073b5194a98f0e01b25cefaace262f8ea508d1991
Instruction ID: c2fb67a1f2e7e5e66262f45762acab1a71a87d06662ba77612a4a16b7a6eea85
Opcode Fuzzy Hash: 0b4349dba64da8df61b8a50073b5194a98f0e01b25cefaace262f8ea508d1991
Instruction Fuzzy Hash: 19E08C11F1AA0683EF0A8B7AFC6007522A6AF48B80B041430CD1F96362EE2DF6D18708

Function 00007FFDA354CC10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDA354CC35

Strings

POINT must be a tuple of 2 ints (x,y), xrefs: 00007FFDA354CC2B
ll;POINT must be a tuple of 2 ints (x,y), xrefs: 00007FFDA354CC49

Memory Dump Source

Source File: 00000002.00000002.3412924469.00007FFDA3541000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDA3540000, based on PE: true

Associated: 00000002.00000002.3412906003.00007FFDA3540000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412947554.00007FFDA3551000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412972078.00007FFDA355F000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3412988997.00007FFDA3562000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3540000_user.jbxd

Similarity

API ID: Err_String
String ID: POINT must be a tuple of 2 ints (x,y)$ll;POINT must be a tuple of 2 ints (x,y)
API String ID: 1450464846-334919720
Opcode ID: bb86c514a6f5b80bd517a3355d44e97f5c100e51a03659f47b0f39897d6151d1
Instruction ID: 8e96d52c542cf21a705b0713fae7df49aee2bb05c04a547d7d18769bbb568762
Opcode Fuzzy Hash: bb86c514a6f5b80bd517a3355d44e97f5c100e51a03659f47b0f39897d6151d1
Instruction Fuzzy Hash: F3E09261F06B02C0DA058F1DD8901A427A2FB48B84F85C432C60E67322CE3EF299C708

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report user.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\mfc140u.dll

C:\Users\user\AppData\Local\Temp\_MEI24482\Pythonwin\win32ui.pyd

C:\Users\user\AppData\Local\Temp\_MEI24482\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI24482\VCRUNTIME140_1.dll

C:\Users\user\AppData\Local\Temp\_MEI24482\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI24482\_cffi_backend.cp313-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI24482\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI24482\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI24482\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI24482\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI24482\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI24482\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI24482\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI24482\_wmi.pyd

C:\Users\user\AppData\Local\Temp\_MEI24482\base_library.zip

C:\Users\user\AppData\Local\Temp\_MEI24482\certifi\cacert.pem

C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md.cp313-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI24482\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info\INSTALLER

C:\Users\user\AppData\Local\Temp\_MEI24482\cryptography-43.0.3.dist-info\METADATA

Windows Analysis Report
user.exe

C:\Users\user\AppData\Local\Temp\gen_py\3.13\init.py

Function 00007FF7157589E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Function 00007FF715751000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Function 00007FF715775C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Function 00007FF715776964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00007FF715775E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Function 00007FF715751950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Function 00007FF715751600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre