Edit tour

Windows Analysis Report
datasett.exe

Overview

General Information

Sample name:	datasett.exe
Analysis ID:	1580468
MD5:	3a90d6fa7c4cccd6ec03eb0667807b5b
SHA1:	3c88e16a010d5b464be251107bfb17de08daa445
SHA256:	339b04f57ff45915e7eb52ec9dca9bc85375a13028ade3d310a357fb79c4e5b0
Tags:	exesolvolume-funuser-aachum
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to infect the boot sector

Found pyInstaller with non standard icon

Potentially malicious time measurement code found

Uses schtasks.exe or at.exe to add and modify task schedules

Binary contains a suspicious time stamp

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May use bcdedit to modify the Windows boot settings

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

datasett.exe (PID: 6864 cmdline: "C:\Users\user\Desktop\datasett.exe" MD5: 3A90D6FA7C4CCCD6EC03EB0667807B5B)

datasett.exe (PID: 5756 cmdline: "C:\Users\user\Desktop\datasett.exe" MD5: 3A90D6FA7C4CCCD6EC03EB0667807B5B)

cmd.exe (PID: 2916 cmdline: C:\Windows\system32\cmd.exe /c schtasks /create /sc MINUTE /mo 15 /tn "VirboUpd" /tr "C:\Users\user\Desktop\datasett.exe" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5968 cmdline: schtasks /create /sc MINUTE /mo 15 /tn "VirboUpd" /tr "C:\Users\user\Desktop\datasett.exe" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

datasett.exe (PID: 5052 cmdline: C:\Users\user\Desktop\datasett.exe MD5: 3A90D6FA7C4CCCD6EC03EB0667807B5B)

datasett.exe (PID: 2836 cmdline: C:\Users\user\Desktop\datasett.exe MD5: 3A90D6FA7C4CCCD6EC03EB0667807B5B)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: datasett.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: datasett.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B21CC0 PyCMethod_New,CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,clock,clock,clock,clock,CryptReleaseContext,	1_2_61B21CC0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B21CC0 PyCMethod_New,CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,clock,clock,clock,clock,CryptReleaseContext,	6_2_61B21CC0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE013461A0 ERR_put_error,CRYPTO_free,ERR_put_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	6_2_00007FFE013461A0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0133E1B0 CRYPTO_THREAD_run_once,	6_2_00007FFE0133E1B0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01360160 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	6_2_00007FFE01360160
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01322365 CRYPTO_free,CRYPTO_malloc,ERR_put_error,memcpy,	6_2_00007FFE01322365
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01338210 EVP_PKEY_CTX_new,EVP_PKEY_derive_init,EVP_PKEY_derive_set_peer,EVP_PKEY_derive,CRYPTO_malloc,EVP_PKEY_derive,CRYPTO_clear_free,EVP_PKEY_CTX_free,	6_2_00007FFE01338210
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0132E220 CRYPTO_malloc,	6_2_00007FFE0132E220
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0135A1E0 CRYPTO_memcmp,	6_2_00007FFE0135A1E0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE013361F0 CRYPTO_free,	6_2_00007FFE013361F0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0137C080 CRYPTO_memcmp,	6_2_00007FFE0137C080
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE013240AA BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	6_2_00007FFE013240AA
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE013360B8 CRYPTO_free,CRYPTO_strdup,	6_2_00007FFE013360B8
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0133C070 CRYPTO_zalloc,ERR_put_error,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,	6_2_00007FFE0133C070
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01322216 CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	6_2_00007FFE01322216
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321050 EVP_PKEY_free,BN_num_bits,BN_bn2bin,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_clear_free,	6_2_00007FFE01321050
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE013221BC _time64,CRYPTO_free,CRYPTO_malloc,EVP_sha256,EVP_Digest,EVP_MD_size,CRYPTO_free,CRYPTO_free,	6_2_00007FFE013221BC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321E79 CRYPTO_free,CRYPTO_malloc,	6_2_00007FFE01321E79
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE013215C8 EVP_MD_CTX_new,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestUpdate,EVP_DigestSignFinal,EVP_DigestSign,BUF_reverse,CRYPTO_free,EVP_MD_CTX_free,CRYPTO_free,EVP_MD_CTX_free,	6_2_00007FFE013215C8
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01370350 CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	6_2_00007FFE01370350
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE013222C0 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	6_2_00007FFE013222C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01328410 CRYPTO_zalloc,ERR_put_error,	6_2_00007FFE01328410
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321BC7 CRYPTO_strdup,CRYPTO_free,	6_2_00007FFE01321BC7
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01360430 CRYPTO_free,CRYPTO_free,	6_2_00007FFE01360430
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321FB9 CRYPTO_free,	6_2_00007FFE01321FB9
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321131 CRYPTO_free,	6_2_00007FFE01321131
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01380250 EVP_PKEY_get0_RSA,RSA_size,CRYPTO_malloc,RAND_priv_bytes,CRYPTO_free,	6_2_00007FFE01380250
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321CB7 CRYPTO_clear_free,	6_2_00007FFE01321CB7
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321523 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	6_2_00007FFE01321523
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01342310 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	6_2_00007FFE01342310
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0136833B CRYPTO_clear_free,	6_2_00007FFE0136833B
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321B7C CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	6_2_00007FFE01321B7C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321AC3 CRYPTO_malloc,ERR_put_error,CRYPTO_free,	6_2_00007FFE01321AC3
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01388570 CRYPTO_free,CRYPTO_malloc,ERR_put_error,	6_2_00007FFE01388570
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01354630 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	6_2_00007FFE01354630
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01324487 CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	6_2_00007FFE01324487
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321F0F CRYPTO_free,	6_2_00007FFE01321F0F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0132135C memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	6_2_00007FFE0132135C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0135A460 CRYPTO_free,CRYPTO_memdup,	6_2_00007FFE0135A460
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321762 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	6_2_00007FFE01321762
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE013284C0 CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,	6_2_00007FFE013284C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0132240F CRYPTO_free,BIO_clear_flags,BIO_set_flags,BIO_snprintf,ERR_add_error_data,memcpy,	6_2_00007FFE0132240F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321F32 CRYPTO_free,CRYPTO_malloc,RAND_bytes,	6_2_00007FFE01321F32
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0134C790 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	6_2_00007FFE0134C790
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE013727B0 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,	6_2_00007FFE013727B0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01380760 BN_bin2bn,BN_ucmp,BN_is_zero,CRYPTO_free,CRYPTO_strdup,	6_2_00007FFE01380760
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321BDB EVP_MD_size,RAND_bytes,_time64,CRYPTO_free,CRYPTO_memdup,	6_2_00007FFE01321BDB
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0132214E CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,ENGINE_finish,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	6_2_00007FFE0132214E
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321393 OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_clear_error,OPENSSL_sk_value,X509_get0_pubkey,X509_free,X509_up_ref,X509_free,OPENSSL_sk_pop_free,	6_2_00007FFE01321393
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE013787F0 CRYPTO_memcmp,	6_2_00007FFE013787F0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0132132A CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,	6_2_00007FFE0132132A
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0135A680 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	6_2_00007FFE0135A680
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01322225 CRYPTO_free,	6_2_00007FFE01322225
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE013246B0 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	6_2_00007FFE013246B0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0132101E CRYPTO_free,CRYPTO_free,	6_2_00007FFE0132101E
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321C03 CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	6_2_00007FFE01321C03
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE013606C0 CRYPTO_memcmp,	6_2_00007FFE013606C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321DBB BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_put_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	6_2_00007FFE01321DBB
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01328980 CRYPTO_free,	6_2_00007FFE01328980
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321FCD CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	6_2_00007FFE01321FCD
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01368947 CRYPTO_malloc,	6_2_00007FFE01368947
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01380950 OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,CRYPTO_memcmp,OPENSSL_sk_push,OPENSSL_sk_num,CRYPTO_free,X509_free,OPENSSL_sk_pop_free,OPENSSL_sk_value,X509_get0_pubkey,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,	6_2_00007FFE01380950
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0134CA20 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	6_2_00007FFE0134CA20
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE013609E0 CRYPTO_free,CRYPTO_memdup,	6_2_00007FFE013609E0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0133A9F0 CRYPTO_THREAD_run_once,	6_2_00007FFE0133A9F0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0133C8B0 OPENSSL_sk_num,X509_STORE_CTX_new,ERR_put_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_put_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_put_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	6_2_00007FFE0133C8B0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321D5C CRYPTO_clear_free,	6_2_00007FFE01321D5C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01322464 CRYPTO_malloc,memcpy,	6_2_00007FFE01322464
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0134C930 CRYPTO_free,CRYPTO_free,	6_2_00007FFE0134C930
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01378BA0 CRYPTO_free,CRYPTO_memdup,	6_2_00007FFE01378BA0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321479 CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	6_2_00007FFE01321479
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0132163B CRYPTO_free,CRYPTO_malloc,	6_2_00007FFE0132163B
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321195 CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	6_2_00007FFE01321195
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0136CB60 EVP_CIPHER_CTX_free,CRYPTO_free,CRYPTO_free,	6_2_00007FFE0136CB60
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01322306 CRYPTO_memcmp,memchr,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	6_2_00007FFE01322306
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321924 BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	6_2_00007FFE01321924
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321078 CRYPTO_free,	6_2_00007FFE01321078
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01360BD0 CRYPTO_free,CRYPTO_strndup,	6_2_00007FFE01360BD0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0134CBE0 ERR_put_error,ERR_put_error,ERR_put_error,EVP_MD_size,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,d2i_X509,X509_get0_pubkey,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_put_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,ERR_put_error,	6_2_00007FFE0134CBE0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01354A90 CRYPTO_zalloc,ERR_put_error,_time64,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,memcpy,	6_2_00007FFE01354A90
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01358A60 CRYPTO_zalloc,CRYPTO_free,	6_2_00007FFE01358A60
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0136AB30 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,	6_2_00007FFE0136AB30

Source: datasett.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb## source: _decimal.pyd.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-39\Release\win32event.pdb source: datasett.exe, 00000000.00000003.1673033158.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2916641506.00007FFE11BB5000.00000002.00000001.01000000.00000016.sdmp, datasett.exe, 00000005.00000003.1727990973.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1760479789.00007FFE0C0A5000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdbMM source: datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2916066006.00007FFE0EB5D000.00000002.00000001.01000000.00000014.sdmp, datasett.exe, 00000005.00000003.1721207686.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1759850177.00007FFE0074D000.00000002.00000001.01000000.0000002A.sdmp, _lzma.pyd.5.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\select.pdb source: datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2917570393.00007FFE148E4000.00000002.00000001.01000000.0000000A.sdmp, datasett.exe, 00000005.00000003.1727282533.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1761926164.00007FFE11074000.00000002.00000001.01000000.00000020.sdmp, select.pyd.5.dr, select.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_uuid.pdb source: datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2917028198.00007FFE120C3000.00000002.00000001.01000000.00000015.sdmp, datasett.exe, 00000005.00000003.1722333278.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1760668819.00007FFE0CF83000.00000002.00000001.01000000.0000002B.sdmp, _uuid.pyd.0.dr
Source:	Binary string: MSTTSLoc.pdbGCTL source: MSTTSLoc.dll.0.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: datasett.exe, 00000001.00000002.2915687874.00007FFE01445000.00000002.00000001.01000000.0000000D.sdmp, datasett.exe, 00000006.00000002.1760119655.00007FFE01395000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_bz2.pdb source: datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2916312250.00007FFE1030E000.00000002.00000001.01000000.00000013.sdmp, datasett.exe, 00000005.00000003.1716730085.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1760283252.00007FFE014CE000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: datasett.exe, 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmp, datasett.exe, 00000006.00000002.1758697606.00007FFDFA91F000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: SpeechUX.pdb source: SpeechUX.dll.5.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_queue.pdb source: datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2917339362.00007FFE130C3000.00000002.00000001.01000000.0000000F.sdmp, datasett.exe, 00000005.00000003.1721765801.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1761741700.00007FFE10233000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_ssl.pdb source: datasett.exe, 00000001.00000002.2916407431.00007FFE1150D000.00000002.00000001.01000000.0000000B.sdmp, datasett.exe, 00000006.00000002.1760767373.00007FFE0CF9D000.00000002.00000001.01000000.00000021.sdmp, _ssl.pyd.5.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-39\Release\win32api.pdb!! source: datasett.exe, 00000001.00000002.2915837657.00007FFE0E143000.00000002.00000001.01000000.00000019.sdmp, datasett.exe, 00000006.00000002.1759648415.00007FFE00183000.00000002.00000001.01000000.0000002F.sdmp, win32api.pyd.0.dr, win32api.pyd.5.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_hashlib.pdb source: datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2916749884.00007FFE11EA7000.00000002.00000001.01000000.0000000E.sdmp, datasett.exe, 00000005.00000003.1720689626.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1760572192.00007FFE0C0B7000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: SpTip.pdbGCTL source: datasett.exe, 00000000.00000003.1675507745.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1730534935.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\a01\_work\4\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: datasett.exe, 00000000.00000003.1667361976.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2916545747.00007FFE117E5000.00000002.00000001.01000000.00000018.sdmp, datasett.exe, 00000005.00000003.1716634961.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1760381109.00007FFE0B2C5000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdb source: datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2916066006.00007FFE0EB5D000.00000002.00000001.01000000.00000014.sdmp, datasett.exe, 00000005.00000003.1721207686.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1759850177.00007FFE0074D000.00000002.00000001.01000000.0000002A.sdmp, _lzma.pyd.5.dr
Source:	Binary string: in32event.pdb source: datasett.exe
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: datasett.exe, 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmp, datasett.exe, 00000006.00000002.1758697606.00007FFDFA91F000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: d:\a01\_work\4\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: datasett.exe, 00000000.00000003.1667214039.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2917766399.00007FFE1A481000.00000002.00000001.01000000.00000005.sdmp, datasett.exe, 00000005.00000003.1716510320.000001D3521D3000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1761534002.00007FFE101E1000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-39\Release\pywintypes.pdb** source: datasett.exe, 00000001.00000002.2915941722.00007FFE0E170000.00000002.00000001.01000000.00000017.sdmp, datasett.exe, 00000006.00000002.1759754239.00007FFE001B0000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: SpeechUX.pdbGCTL source: SpeechUX.dll.5.dr
Source:	Binary string: MSTTSLoc.pdb source: MSTTSLoc.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_ctypes.pdb source: datasett.exe, 00000001.00000002.2916894677.00007FFE11ED1000.00000002.00000001.01000000.00000006.sdmp, datasett.exe, 00000006.00000002.1760911705.00007FFE0CFD1000.00000002.00000001.01000000.0000001C.sdmp, _ctypes.pyd.5.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-39\Release\win32api.pdb source: datasett.exe, 00000001.00000002.2915837657.00007FFE0E143000.00000002.00000001.01000000.00000019.sdmp, datasett.exe, 00000006.00000002.1759648415.00007FFE00183000.00000002.00000001.01000000.0000002F.sdmp, win32api.pyd.0.dr, win32api.pyd.5.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: datasett.exe, 00000001.00000002.2915687874.00007FFE01445000.00000002.00000001.01000000.0000000D.sdmp, datasett.exe, 00000006.00000002.1760119655.00007FFE01395000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: SpeechUXPS.pdbGCTL source: datasett.exe, 00000000.00000003.1676047096.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1731666439.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_socket.pdb source: datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2917454297.00007FFE13309000.00000002.00000001.01000000.00000009.sdmp, datasett.exe, 00000005.00000003.1721954880.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1761102081.00007FFE0EB29000.00000002.00000001.01000000.0000001F.sdmp, _socket.pyd.5.dr, _socket.pyd.0.dr
Source:	Binary string: SpTip.pdb source: datasett.exe, 00000000.00000003.1675507745.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1730534935.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-39\Release\pywintypes.pdb source: datasett.exe, 00000001.00000002.2915941722.00007FFE0E170000.00000002.00000001.01000000.00000017.sdmp, datasett.exe, 00000006.00000002.1759754239.00007FFE001B0000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\unicodedata.pdb source: datasett.exe, 00000000.00000003.1672614789.000002CBEB84F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmp, datasett.exe, 00000005.00000003.1727515209.000001D3521DE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1759427402.00007FFDFBABB000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\python39.pdb source: datasett.exe, 00000001.00000002.2915271158.00007FFDFB643000.00000002.00000001.01000000.00000004.sdmp, datasett.exe, 00000006.00000002.1759072943.00007FFDFAD53000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: SpeechUXPS.pdb source: datasett.exe, 00000000.00000003.1676047096.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1731666439.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: datasett.exe, 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmp, datasett.exe, 00000006.00000002.1758697606.00007FFDFA9A1000.00000002.00000001.01000000.00000022.sdmp

Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF7996909B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7996909B4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799686714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF799686714
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799686714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF799686714
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799677820 FindFirstFileExW,FindClose,	0_2_00007FF799677820
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF7996909B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF7996909B4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799686714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF799686714
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799686714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF799686714
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799677820 FindFirstFileExW,FindClose,	1_2_00007FF799677820
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D3229 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,	6_2_00007FFDFA6D3229
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00173740 _PyArg_ParseTuple_SizeT,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyList_New,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindFirstFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyObject_FromWIN32_FIND_DATAW@@YAPEAU_object@@PEAU_WIN32_FIND_DATAW@@@Z,PyList_Append,_Py_Dealloc,FindNextFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindClose,_Py_Dealloc,	6_2_00007FFE00173740

Source: C:\Users\user\Desktop\datasett.exe

Code function: 6_2_00007FFE001755D0 _PyArg_ParseTuple_SizeT,GetLogicalDriveStringsW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,GetLogicalDriveStringsW,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W_J@Z,

6_2_00007FFE001755D0

Source: Joe Sandbox View

IP Address: 104.26.3.46 104.26.3.46

Source: unknown

DNS query: name: iplogger.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\datasett.exe

Code function: 1_2_61B13000 WSAStartup,gethostbyname,socket,setsockopt,setsockopt,setsockopt,htons,sendto,sendto,recvfrom,recvfrom,ntohl,ntohl,ntohl,closesocket,WSACleanup,WSAGetLastError,closesocket,WSACleanup,SetLastError,WSAGetLastError,WSACleanup,SetLastError,

1_2_61B13000

Source: global traffic

DNS traffic detected: DNS query: iplogger.org

Source: datasett.exe, 00000001.00000002.2913572705.000001CA11710000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1746646839.0000028850A1F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757882425.0000028850D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB84F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB851000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724156433.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB84F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB851000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1723056484.000001D3521E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1723056484.000001D3521E2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1716730085.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1718158484.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1727515209.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB855000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1723056484.000001D3521E2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1727282533.000001D3521E4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1716730085.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1718158484.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: datasett.exe, 00000001.00000002.2912355486.000001CA10AE3000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2913343331.000001CA113A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl$hxw
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724156433.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlerr
Source: datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724156433.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB84F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB851000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1723056484.000001D3521E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB855000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1723056484.000001D3521E2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1727282533.000001D3521E4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1716730085.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB855000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1723056484.000001D3521E2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1727282533.000001D3521E4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1716730085.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1718158484.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724156433.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB84F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB851000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1723056484.000001D3521E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB84F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB851000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1721207686.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSign
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB855000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1723056484.000001D3521E2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1727282533.000001D3521E4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1716730085.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1718158484.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1727515209.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724156433.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB84F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB851000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1723056484.000001D3521E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: datasett.exe, 00000001.00000002.2913296015.000001CA112C0000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757849481.0000028850CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1755830091.000002884E312000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753785930.000002884E30E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753458207.000002884E30D000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754788827.000002884E311000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: datasett.exe, 00000001.00000002.2912355486.000001CA10AE3000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757216796.00000288508C0000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: datasett.exe, 00000001.00000002.2912355486.000001CA10AE3000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1755081662.0000028850539000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1746858969.00000288504DD000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1755383513.0000028850539000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753649523.000002885088E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756677827.0000028850539000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752944599.0000028850874000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752759804.0000028850537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: datasett.exe, 00000006.00000003.1754572349.00000288508EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.ese
Source: datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digi
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1723056484.000001D3521E2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1716730085.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1718158484.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1727515209.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB855000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1723056484.000001D3521E2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1727282533.000001D3521E4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1716730085.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1718158484.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB84F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB851000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724156433.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB84F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB851000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1723056484.000001D3521E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digif
Source: datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724156433.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912643746.000001CA10E85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10E85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/a
Source: datasett.exe, 00000001.00000002.2913193358.000001CA111D0000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757764425.0000028850BF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724156433.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724156433.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724156433.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: datasett.exe, 00000001.00000002.2912355486.000001CA10AE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm9hxj
Source: datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/A
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB84F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB851000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1723056484.000001D3521E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1755318713.0000028850540000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1746858969.00000288504DD000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756677827.0000028850541000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753339807.000002885053F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752759804.0000028850537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: datasett.exe, 00000006.00000003.1754037534.0000028850461000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754075017.0000028850465000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754502410.000002885046D000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754328484.0000028850466000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756488404.0000028850470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.robotstxt.org/norobots-rfc.txt
Source: datasett.exe, 00000001.00000002.2913343331.000001CA113A0000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757339264.0000028850934000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.0000028850924000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753139716.0000028850932000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1755344880.0000028850934000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751520665.0000028850915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org?format=json
Source: datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: datasett.exe, 00000001.00000002.2913023346.000001CA11070000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757610535.0000028850A90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757421956.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.000002885095E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752786045.0000028850945000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753256581.0000028850946000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: datasett.exe, 00000001.00000003.1685920181.000001CA0EAB7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684134076.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680524631.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680369460.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683770842.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680369460.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680315220.000001CA0EADF000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683979233.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680192150.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684134076.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680524631.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683770842.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680684974.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680328707.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683979233.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683478506.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680684974.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683478506.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754037534.0000028850461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: datasett.exe, datasett.exe, 00000006.00000002.1759792495.00007FFE001C1000.00000002.00000001.01000000.0000002D.sdmp, datasett.exe, 00000006.00000002.1760517859.00007FFE0C0A9000.00000002.00000001.01000000.0000002C.sdmp, datasett.exe, 00000006.00000002.1759686551.00007FFE00191000.00000002.00000001.01000000.0000002F.sdmp, win32api.pyd.0.dr, win32api.pyd.5.dr	String found in binary or memory: https://github.com/mhammond/pywin32
Source: datasett.exe, 00000001.00000003.1685920181.000001CA0EAB7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684134076.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680369460.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680192150.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680524631.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683770842.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680684974.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912089151.000001CA102F0000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680328707.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683979233.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683478506.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756225617.0000028850060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: datasett.exe, 00000006.00000003.1754601960.000002884E349000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: datasett.exe, 00000001.00000003.1685920181.000001CA0EAB7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684134076.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680524631.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680369460.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683770842.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680369460.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680315220.000001CA0EADF000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683979233.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680192150.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684134076.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680524631.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683770842.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680684974.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680328707.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683979233.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683478506.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680684974.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683478506.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754037534.0000028850461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: datasett.exe, 00000001.00000003.1685920181.000001CA0EAB7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684134076.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680524631.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680369460.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683770842.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680369460.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680315220.000001CA0EADF000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683979233.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680192150.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684134076.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680524631.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683770842.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680684974.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680328707.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683979233.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683478506.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680684974.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683478506.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754037534.0000028850461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: datasett.exe, 00000001.00000002.2913023346.000001CA11070000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757610535.0000028850A90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754014840.00000288508C6000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: datasett.exe, 00000001.00000002.2913229256.000001CA11220000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757421956.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.0000028850955000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752786045.0000028850945000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753256581.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757792500.0000028850C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: datasett.exe, 00000006.00000002.1757792500.0000028850C40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920p
Source: datasett.exe, 00000006.00000003.1753256581.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752439883.000002884E347000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: datasett.exe, 00000001.00000002.2912355486.000001CA10AE3000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757421956.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1755060297.00000288508C7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.0000028850955000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754014840.00000288508C6000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752786045.0000028850945000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753256581.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: datasett.exe, 00000006.00000003.1754433045.000002884E3C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752494608.00000288508E2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754249502.00000288508EB000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752863410.00000288508EA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754770494.00000288508F6000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754572349.00000288508EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: datasett.exe, 00000006.00000003.1752439883.000002884E347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: datasett.exe, 00000006.00000002.1758008992.0000028850DD0000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756488404.0000028850470000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752999911.00000288504DD000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754572349.00000288508EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1755865343.000002884E32B000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753742679.000002884E325000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754885711.000002884E32A000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753458207.000002884E30D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/Drop8VbLink
Source: datasett.exe, 00000006.00000002.1756885684.00000288505F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/Drop8otstuk
Source: datasett.exe, 00000001.00000003.1685920181.000001CA0EAB7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1686004054.000001CA0EAF2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752494608.00000288508E2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754249502.00000288508EB000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752863410.00000288508EA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754753546.00000288508FE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1743252369.000002884E3C0000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1743133519.000002884E3BC000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754572349.00000288508EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/C1vS7y2X
Source: datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/fn5bRN1F
Source: datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/uUbM2VAB
Source: datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/uUbM2VAB__path__
Source: datasett.exe, 00000006.00000002.1759072943.00007FFDFAD53000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: datasett.exe, 00000006.00000002.1758039593.0000028850E10000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1755865343.000002884E32B000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753742679.000002884E325000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754885711.000002884E32A000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753458207.000002884E30D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753093881.000002884E39C000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752439883.000002884E347000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753503603.000002884E3A2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753676136.000002884E3AE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756028776.000002884E3B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: datasett.exe, 00000001.00000002.2912355486.000001CA10AE3000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757421956.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753093881.000002884E39C000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.0000028850955000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752786045.0000028850945000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753256581.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752439883.000002884E347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: datasett.exe, 00000001.00000002.2913193358.000001CA111D0000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757764425.0000028850BF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: datasett.exe, 00000001.00000002.2913158600.000001CA11190000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757734662.0000028850BB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: datasett.exe, 00000001.00000002.2913158600.000001CA11190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningspf
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB84F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1671352104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668412980.000002CBEB851000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669320414.000002CBEB852000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1672614789.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1725566995.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmp, datasett.exe, 00000001.00000002.2915732229.00007FFE0147A000.00000002.00000001.01000000.0000000D.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1758860580.00007FFDFAA17000.00000002.00000001.01000000.00000022.sdmp, datasett.exe, 00000006.00000002.1760185978.00007FFE013CA000.00000002.00000001.01000000.00000023.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1755865343.000002884E32B000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753742679.000002884E325000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754885711.000002884E32A000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753458207.000002884E30D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: datasett.exe, 00000001.00000003.1685920181.000001CA0EAB7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1686004054.000001CA0EAF2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752494608.00000288508E2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754249502.00000288508EB000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752863410.00000288508EA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754753546.00000288508FE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1743252369.000002884E3C0000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1743133519.000002884E3BC000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754572349.00000288508EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: datasett.exe, 00000000.00000003.1678160567.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912516810.000001CA10BD0000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1736245775.000001D3521D8000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756885684.00000288505F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: datasett.exe, 00000001.00000003.1684836609.000001CA0EAF8000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912253685.000001CA10880000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684777469.000001CA0EAEC000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684695963.000001CA0EAEC000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684754877.000001CA0EAF8000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1742795678.000002884E3B6000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756347653.00000288502A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: datasett.exe, 00000001.00000002.2912355486.000001CA10AE3000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757421956.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1755060297.00000288508C7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.0000028850955000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754014840.00000288508C6000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752786045.0000028850945000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753256581.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: C:\Users\user\Desktop\datasett.exe

Code function: 6_2_00007FFE00175140 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,GetKeyboardState,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,

6_2_00007FFE00175140

Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B13000 WSAStartup,gethostbyname,socket,setsockopt,setsockopt,setsockopt,htons,sendto,sendto,recvfrom,recvfrom,ntohl,ntohl,ntohl,closesocket,WSACleanup,WSAGetLastError,closesocket,WSACleanup,SetLastError,WSAGetLastError,WSACleanup,SetLastError,		1_2_61B13000
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B13000 WSAStartup,gethostbyname,socket,setsockopt,setsockopt,setsockopt,htons,sendto,sendto,recvfrom,recvfrom,ntohl,ntohl,ntohl,closesocket,WSACleanup,WSAGetLastError,closesocket,WSACleanup,SetLastError,WSAGetLastError,WSACleanup,SetLastError,		6_2_61B13000

Source: C:\Users\user\Desktop\datasett.exe

Code function: 1_2_61B9F1F8: DeviceIoControl,

1_2_61B9F1F8

Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00175AC0 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,		6_2_00007FFE00175AC0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00175B60 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,		6_2_00007FFE00175B60

Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF79968FA08	0_2_00007FF79968FA08
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799694E20	0_2_00007FF799694E20
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799695D6C	0_2_00007FF799695D6C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799676780	0_2_00007FF799676780
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF7996931CC	0_2_00007FF7996931CC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF7996811C0	0_2_00007FF7996811C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF7996909B4	0_2_00007FF7996909B4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF7996809A0	0_2_00007FF7996809A0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799671B90	0_2_00007FF799671B90
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799698B68	0_2_00007FF799698B68
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF79968CC04	0_2_00007FF79968CC04
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799682C04	0_2_00007FF799682C04
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF7996813C4	0_2_00007FF7996813C4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799688BA0	0_2_00007FF799688BA0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799680BA4	0_2_00007FF799680BA4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799681E70	0_2_00007FF799681E70
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799686714	0_2_00007FF799686714
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF79968FA08	0_2_00007FF79968FA08
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799686560	0_2_00007FF799686560
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799692D30	0_2_00007FF799692D30
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799680DB0	0_2_00007FF799680DB0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799686714	0_2_00007FF799686714
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799695820	0_2_00007FF799695820
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF79968D098	0_2_00007FF79968D098
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF79969509C	0_2_00007FF79969509C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF7996780A0	0_2_00007FF7996780A0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799684F50	0_2_00007FF799684F50
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF79968D718	0_2_00007FF79968D718
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799682800	0_2_00007FF799682800
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799680FB4	0_2_00007FF799680FB4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799686F98	0_2_00007FF799686F98
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B04A60	1_2_61B04A60
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B05E70	1_2_61B05E70
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B3F1E2	1_2_61B3F1E2
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B25120	1_2_61B25120
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B16080	1_2_61B16080
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B21010	1_2_61B21010
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B5E310	1_2_61B5E310
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B56350	1_2_61B56350
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B46340	1_2_61B46340
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B0B290	1_2_61B0B290
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B07220	1_2_61B07220
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B7C5C0	1_2_61B7C5C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B54530	1_2_61B54530
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B25510	1_2_61B25510
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B3F570	1_2_61B3F570
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B15400	1_2_61B15400
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B09710	1_2_61B09710
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B65690	1_2_61B65690
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B7E660	1_2_61B7E660
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B28900	1_2_61B28900
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B19960	1_2_61B19960
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B2B8D0	1_2_61B2B8D0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B55830	1_2_61B55830
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B10820	1_2_61B10820
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B06BA0	1_2_61B06BA0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B7CB90	1_2_61B7CB90
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B2BB50	1_2_61B2BB50
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B13B40	1_2_61B13B40
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B64A90	1_2_61B64A90
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B25A00	1_2_61B25A00
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B26A60	1_2_61B26A60
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B53D70	1_2_61B53D70
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B02D60	1_2_61B02D60
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B13CC0	1_2_61B13CC0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B14C20	1_2_61B14C20
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B56FC0	1_2_61B56FC0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B64F70	1_2_61B64F70
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B23F60	1_2_61B23F60
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B29F40	1_2_61B29F40
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B26E80	1_2_61B26E80
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B54E15	1_2_61B54E15
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B21E40	1_2_61B21E40
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799695D6C	1_2_00007FF799695D6C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF79968FA08	1_2_00007FF79968FA08
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF7996931CC	1_2_00007FF7996931CC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF7996811C0	1_2_00007FF7996811C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF7996909B4	1_2_00007FF7996909B4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF7996809A0	1_2_00007FF7996809A0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799671B90	1_2_00007FF799671B90
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799698B68	1_2_00007FF799698B68
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF79968CC04	1_2_00007FF79968CC04
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799682C04	1_2_00007FF799682C04
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF7996813C4	1_2_00007FF7996813C4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799688BA0	1_2_00007FF799688BA0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799680BA4	1_2_00007FF799680BA4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799681E70	1_2_00007FF799681E70
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799694E20	1_2_00007FF799694E20
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799686714	1_2_00007FF799686714
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF79968FA08	1_2_00007FF79968FA08
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799686560	1_2_00007FF799686560
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799692D30	1_2_00007FF799692D30
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799680DB0	1_2_00007FF799680DB0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799686714	1_2_00007FF799686714
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799695820	1_2_00007FF799695820
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF79968D098	1_2_00007FF79968D098
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF79969509C	1_2_00007FF79969509C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF7996780A0	1_2_00007FF7996780A0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799676780	1_2_00007FF799676780
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799684F50	1_2_00007FF799684F50
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF79968D718	1_2_00007FF79968D718
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799682800	1_2_00007FF799682800
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799680FB4	1_2_00007FF799680FB4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799686F98	1_2_00007FF799686F98
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAEA12C0	1_2_00007FFDFAEA12C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAEA1890	1_2_00007FFDFAEA1890
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB163B80	1_2_00007FFDFB163B80
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB177BC0	1_2_00007FFDFB177BC0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC6A87	1_2_00007FFDFAFC6A87
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC655F	1_2_00007FFDFAFC655F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC60A0	1_2_00007FFDFAFC60A0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB02FA00	1_2_00007FFDFB02FA00
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC4165	1_2_00007FFDFAFC4165
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC3FDA	1_2_00007FFDFAFC3FDA
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC22E8	1_2_00007FFDFAFC22E8
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC21B7	1_2_00007FFDFAFC21B7
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC2766	1_2_00007FFDFAFC2766
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB0F0010	1_2_00007FFDFB0F0010
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC32E7	1_2_00007FFDFAFC32E7
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFDBF20	1_2_00007FFDFAFDBF20
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC2289	1_2_00007FFDFAFC2289
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFDBD60	1_2_00007FFDFAFDBD60
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB0F7CD0	1_2_00007FFDFB0F7CD0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC30C1	1_2_00007FFDFAFC30C1
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC6EF1	1_2_00007FFDFAFC6EF1
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC5D8A	1_2_00007FFDFAFC5D8A
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC29CD	1_2_00007FFDFAFC29CD
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC6CBC	1_2_00007FFDFAFC6CBC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC114F	1_2_00007FFDFAFC114F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFDF200	1_2_00007FFDFAFDF200
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB0FB200	1_2_00007FFDFB0FB200
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFDF060	1_2_00007FFDFAFDF060
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC213F	1_2_00007FFDFAFC213F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC704A	1_2_00007FFDFAFC704A
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB1FF7D0	1_2_00007FFDFB1FF7D0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC1EA1	1_2_00007FFDFAFC1EA1
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC6F28	1_2_00007FFDFAFC6F28
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFEB850	1_2_00007FFDFAFEB850
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFEB4C0	1_2_00007FFDFAFEB4C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB0F74F0	1_2_00007FFDFB0F74F0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC5169	1_2_00007FFDFAFC5169
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC3B93	1_2_00007FFDFAFC3B93
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB162C40	1_2_00007FFDFB162C40
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC60DC	1_2_00007FFDFAFC60DC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC4E4E	1_2_00007FFDFAFC4E4E
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC5E25	1_2_00007FFDFAFC5E25
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB14E870	1_2_00007FFDFB14E870
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC23F1	1_2_00007FFDFAFC23F1
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC4633	1_2_00007FFDFAFC4633
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC72C5	1_2_00007FFDFAFC72C5
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB0A2EB0	1_2_00007FFDFB0A2EB0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFDEF00	1_2_00007FFDFAFDEF00
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC1B22	1_2_00007FFDFAFC1B22
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC4D04	1_2_00007FFDFAFC4D04
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC5DA3	1_2_00007FFDFAFC5DA3
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC5B0F	1_2_00007FFDFAFC5B0F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC3486	1_2_00007FFDFAFC3486
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB0F6310	1_2_00007FFDFB0F6310
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC57D1	1_2_00007FFDFAFC57D1
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC4746	1_2_00007FFDFAFC4746
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC378D	1_2_00007FFDFAFC378D
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC4359	1_2_00007FFDFAFC4359
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC1B31	1_2_00007FFDFAFC1B31
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC6FFF	1_2_00007FFDFAFC6FFF
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC1CC1	1_2_00007FFDFAFC1CC1
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB0F2850	1_2_00007FFDFB0F2850
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC1A4B	1_2_00007FFDFAFC1A4B
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC5A60	1_2_00007FFDFAFC5A60
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC707C	1_2_00007FFDFAFC707C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC3693	1_2_00007FFDFAFC3693
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB179B90	1_2_00007FFDFB179B90
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC50AB	1_2_00007FFDFAFC50AB
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC35FD	1_2_00007FFDFAFC35FD
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB161AD0	1_2_00007FFDFB161AD0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC59F7	1_2_00007FFDFAFC59F7
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC4F3E	1_2_00007FFDFAFC4F3E
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC638E	1_2_00007FFDFAFC638E
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC2135	1_2_00007FFDFAFC2135
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC53C1	1_2_00007FFDFAFC53C1
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC4AC5	1_2_00007FFDFAFC4AC5
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC54CF	1_2_00007FFDFAFC54CF
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC216C	1_2_00007FFDFAFC216C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB0F6010	1_2_00007FFDFB0F6010
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC72AC	1_2_00007FFDFAFC72AC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC1622	1_2_00007FFDFAFC1622
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC2D0B	1_2_00007FFDFAFC2D0B
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC3BA2	1_2_00007FFDFAFC3BA2
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC736A	1_2_00007FFDFAFC736A
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC7257	1_2_00007FFDFAFC7257
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC1D83	1_2_00007FFDFAFC1D83
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC2982	1_2_00007FFDFAFC2982
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC1CFD	1_2_00007FFDFAFC1CFD
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC266C	1_2_00007FFDFAFC266C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC3832	1_2_00007FFDFAFC3832
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC3A85	1_2_00007FFDFAFC3A85
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFB1793C0	1_2_00007FFDFB1793C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC710D	1_2_00007FFDFAFC710D
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC53A8	1_2_00007FFDFAFC53A8
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFDD260	1_2_00007FFDFAFDD260
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC68CA	1_2_00007FFDFAFC68CA
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B04A60	6_2_61B04A60
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B05E70	6_2_61B05E70
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B3F1E2	6_2_61B3F1E2
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B25120	6_2_61B25120
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B16080	6_2_61B16080
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B21010	6_2_61B21010
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B5E310	6_2_61B5E310
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B56350	6_2_61B56350
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B46340	6_2_61B46340
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B0B290	6_2_61B0B290
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B07220	6_2_61B07220
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B7C5C0	6_2_61B7C5C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B54530	6_2_61B54530
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B25510	6_2_61B25510
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B3F570	6_2_61B3F570
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B15400	6_2_61B15400
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B09710	6_2_61B09710
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B65690	6_2_61B65690
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B7E660	6_2_61B7E660
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B28900	6_2_61B28900
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B19960	6_2_61B19960
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B2B8D0	6_2_61B2B8D0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B55830	6_2_61B55830
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B10820	6_2_61B10820
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B06BA0	6_2_61B06BA0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B7CB90	6_2_61B7CB90
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B2BB50	6_2_61B2BB50
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B13B40	6_2_61B13B40
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B64A90	6_2_61B64A90
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B25A00	6_2_61B25A00
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B26A60	6_2_61B26A60
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B53D70	6_2_61B53D70
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B02D60	6_2_61B02D60
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B13CC0	6_2_61B13CC0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B14C20	6_2_61B14C20
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B56FC0	6_2_61B56FC0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B64F70	6_2_61B64F70
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B23F60	6_2_61B23F60
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B29F40	6_2_61B29F40
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B26E80	6_2_61B26E80
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B54E15	6_2_61B54E15
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B21E40	6_2_61B21E40
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D6A87	6_2_00007FFDFA6D6A87
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D655F	6_2_00007FFDFA6D655F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA873B80	6_2_00007FFDFA873B80
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA887BC0	6_2_00007FFDFA887BC0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D22E8	6_2_00007FFDFA6D22E8
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D21B7	6_2_00007FFDFA6D21B7
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA73FA00	6_2_00007FFDFA73FA00
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D3FDA	6_2_00007FFDFA6D3FDA
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D60A0	6_2_00007FFDFA6D60A0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4165	6_2_00007FFDFA6D4165
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D2289	6_2_00007FFDFA6D2289
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6EBF20	6_2_00007FFDFA6EBF20
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D32E7	6_2_00007FFDFA6D32E7
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA800010	6_2_00007FFDFA800010
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D2766	6_2_00007FFDFA6D2766
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D30C1	6_2_00007FFDFA6D30C1
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA807CD0	6_2_00007FFDFA807CD0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6EBD60	6_2_00007FFDFA6EBD60
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D6CBC	6_2_00007FFDFA6D6CBC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D29CD	6_2_00007FFDFA6D29CD
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D5D8A	6_2_00007FFDFA6D5D8A
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D6EF1	6_2_00007FFDFA6D6EF1
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6EF060	6_2_00007FFDFA6EF060
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D213F	6_2_00007FFDFA6D213F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA80B200	6_2_00007FFDFA80B200
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D114F	6_2_00007FFDFA6D114F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6EF200	6_2_00007FFDFA6EF200
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D1EA1	6_2_00007FFDFA6D1EA1
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D6F28	6_2_00007FFDFA6D6F28
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6FB850	6_2_00007FFDFA6FB850
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D704A	6_2_00007FFDFA6D704A
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA90F7D0	6_2_00007FFDFA90F7D0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D3B93	6_2_00007FFDFA6D3B93
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6FB4C0	6_2_00007FFDFA6FB4C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA8074F0	6_2_00007FFDFA8074F0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D5169	6_2_00007FFDFA6D5169
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA872C40	6_2_00007FFDFA872C40
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA85E870	6_2_00007FFDFA85E870
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D23F1	6_2_00007FFDFA6D23F1
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D5E25	6_2_00007FFDFA6D5E25
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4E4E	6_2_00007FFDFA6D4E4E
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D60DC	6_2_00007FFDFA6D60DC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D1B22	6_2_00007FFDFA6D1B22
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA7B2EB0	6_2_00007FFDFA7B2EB0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6EEF00	6_2_00007FFDFA6EEF00
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D72C5	6_2_00007FFDFA6D72C5
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4633	6_2_00007FFDFA6D4633
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D5B0F	6_2_00007FFDFA6D5B0F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D5DA3	6_2_00007FFDFA6D5DA3
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4D04	6_2_00007FFDFA6D4D04
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA806310	6_2_00007FFDFA806310
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D3486	6_2_00007FFDFA6D3486
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4746	6_2_00007FFDFA6D4746
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D378D	6_2_00007FFDFA6D378D
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4359	6_2_00007FFDFA6D4359
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D1B31	6_2_00007FFDFA6D1B31
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D57D1	6_2_00007FFDFA6D57D1
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D1A4B	6_2_00007FFDFA6D1A4B
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D5A60	6_2_00007FFDFA6D5A60
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA802850	6_2_00007FFDFA802850
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D6FFF	6_2_00007FFDFA6D6FFF
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D1CC1	6_2_00007FFDFA6D1CC1
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D3693	6_2_00007FFDFA6D3693
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D707C	6_2_00007FFDFA6D707C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA871AD0	6_2_00007FFDFA871AD0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D50AB	6_2_00007FFDFA6D50AB
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA889B90	6_2_00007FFDFA889B90
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D35FD	6_2_00007FFDFA6D35FD
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4AC5	6_2_00007FFDFA6D4AC5
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D54CF	6_2_00007FFDFA6D54CF
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D216C	6_2_00007FFDFA6D216C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D2135	6_2_00007FFDFA6D2135
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D53C1	6_2_00007FFDFA6D53C1
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D59F7	6_2_00007FFDFA6D59F7
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4F3E	6_2_00007FFDFA6D4F3E
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D638E	6_2_00007FFDFA6D638E
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D3BA2	6_2_00007FFDFA6D3BA2
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D2D0B	6_2_00007FFDFA6D2D0B
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA806010	6_2_00007FFDFA806010
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D72AC	6_2_00007FFDFA6D72AC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D1622	6_2_00007FFDFA6D1622
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D3A85	6_2_00007FFDFA6D3A85
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D1CFD	6_2_00007FFDFA6D1CFD
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D3832	6_2_00007FFDFA6D3832
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D266C	6_2_00007FFDFA6D266C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D1D83	6_2_00007FFDFA6D1D83
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D736A	6_2_00007FFDFA6D736A
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D7257	6_2_00007FFDFA6D7257
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D2982	6_2_00007FFDFA6D2982
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6ED260	6_2_00007FFDFA6ED260
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D68CA	6_2_00007FFDFA6D68CA
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D710D	6_2_00007FFDFA6D710D
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D53A8	6_2_00007FFDFA6D53A8
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA8893C0	6_2_00007FFDFA8893C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D3189	6_2_00007FFDFA6D3189
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D1F96	6_2_00007FFDFA6D1F96
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D144C	6_2_00007FFDFA6D144C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA811170	6_2_00007FFDFA811170
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA7FD170	6_2_00007FFDFA7FD170
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6F5200	6_2_00007FFDFA6F5200
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D5510	6_2_00007FFDFA6D5510
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D3A8F	6_2_00007FFDFA6D3A8F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D15C8	6_2_00007FFDFA6D15C8
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D54CA	6_2_00007FFDFA6D54CA
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D1299	6_2_00007FFDFA6D1299
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA8117A0	6_2_00007FFDFA8117A0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D6564	6_2_00007FFDFA6D6564
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D542F	6_2_00007FFDFA6D542F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D560F	6_2_00007FFDFA6D560F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D5F10	6_2_00007FFDFA6D5F10
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D44C6	6_2_00007FFDFA6D44C6
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D5BF0	6_2_00007FFDFA6D5BF0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4287	6_2_00007FFDFA6D4287
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D5047	6_2_00007FFDFA6D5047
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4B56	6_2_00007FFDFA6D4B56
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D11CC	6_2_00007FFDFA6D11CC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4C14	6_2_00007FFDFA6D4C14
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D6D5C	6_2_00007FFDFA6D6D5C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D2D74	6_2_00007FFDFA6D2D74
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA884BC0	6_2_00007FFDFA884BC0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D2FCC	6_2_00007FFDFA6D2FCC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D177B	6_2_00007FFDFA6D177B
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D22AC	6_2_00007FFDFA6D22AC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4A53	6_2_00007FFDFA6D4A53
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D275C	6_2_00007FFDFA6D275C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D1140	6_2_00007FFDFA6D1140
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D10AA	6_2_00007FFDFA6D10AA
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D592F	6_2_00007FFDFA6D592F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D1217	6_2_00007FFDFA6D1217
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D65A0	6_2_00007FFDFA6D65A0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4403	6_2_00007FFDFA6D4403
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D362F	6_2_00007FFDFA6D362F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D6EBF	6_2_00007FFDFA6D6EBF
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D26E9	6_2_00007FFDFA6D26E9
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D22FC	6_2_00007FFDFA6D22FC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA810300	6_2_00007FFDFA810300
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D2E8C	6_2_00007FFDFA6D2E8C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D1424	6_2_00007FFDFA6D1424
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4101	6_2_00007FFDFA6D4101
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D5B73	6_2_00007FFDFA6D5B73
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4C37	6_2_00007FFDFA6D4C37
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA780750	6_2_00007FFDFA780750
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D25EF	6_2_00007FFDFA6D25EF
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D69E7	6_2_00007FFDFA6D69E7
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D6C21	6_2_00007FFDFA6D6C21
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA7FC7D0	6_2_00007FFDFA7FC7D0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6EC480	6_2_00007FFDFA6EC480
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA888490	6_2_00007FFDFA888490
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D2C75	6_2_00007FFDFA6D2C75
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6EC620	6_2_00007FFDFA6EC620
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFB9B1890	6_2_00007FFDFB9B1890
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFB9B12C0	6_2_00007FFDFB9B12C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE001745C0	6_2_00007FFE001745C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00173B20	6_2_00007FFE00173B20
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00173740	6_2_00007FFE00173740
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00737044	6_2_00007FFE00737044
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00732470	6_2_00007FFE00732470
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00731A00	6_2_00007FFE00731A00
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00732EE0	6_2_00007FFE00732EE0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00731B10	6_2_00007FFE00731B10
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00735320	6_2_00007FFE00735320
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0073F650	6_2_00007FFE0073F650
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00731290	6_2_00007FFE00731290
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00735C30	6_2_00007FFE00735C30
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00738F80	6_2_00007FFE00738F80
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01300150	6_2_00007FFE01300150
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE012FC030	6_2_00007FFE012FC030
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE012F3A00	6_2_00007FFE012F3A00
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01380250	6_2_00007FFE01380250
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE0132256D	6_2_00007FFE0132256D
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321BDB	6_2_00007FFE01321BDB
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE013220AE	6_2_00007FFE013220AE
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01380950	6_2_00007FFE01380950
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01326BA0	6_2_00007FFE01326BA0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01321537	6_2_00007FFE01321537

Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFA6D4D68 appears 38 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFA6D688E appears 31 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFAFC4057 appears 531 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFE0138D7E5 appears 42 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 61B9EBF8 appears 112 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFAFC24B9 appears 62 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFAFC1EF1 appears 904 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFE001AC0A0 appears 47 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFA6D698D appears 49 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFA6D300D appears 55 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFAFC300D appears 50 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFE012F3850 appears 51 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFAFC698D appears 35 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFA6D1EF1 appears 1581 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 61B1B860 appears 450 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFA6D24B9 appears 83 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFA6D4057 appears 782 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFAFC2A04 appears 95 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFA6D2734 appears 511 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFE0138D74F appears 63 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFAFC483B appears 90 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFE012F38C0 appears 96 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFAFC2734 appears 357 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFA6D2A04 appears 172 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFE013212EE appears 216 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FFDFA6D483B appears 128 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 61B9EC40 appears 94 times
Source: C:\Users\user\Desktop\datasett.exe	Code function: String function: 00007FF799672770 appears 82 times

Source: sapi.dll.0.dr	Static PE information: Resource name: DATA type: a.out little-endian 32-bit pure executable not stripped
Source: srloc.dll.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: SpeechUX.dll.mui.0.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: SpeechUXRes.dll.0.dr	Static PE information: Resource name: SRGRAMMARS type: COM executable for DOS
Source: SpeechUX.dll.mui0.0.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: SpeechUXRes.dll.5.dr	Static PE information: Resource name: SRGRAMMARS type: COM executable for DOS
Source: SpeechUX.dll.mui.5.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: sapi.dll.5.dr	Static PE information: Resource name: DATA type: a.out little-endian 32-bit pure executable not stripped
Source: srloc.dll.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: SpeechUX.dll.mui0.5.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: unicodedata.pyd.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: pyarmor_runtime.pyd.0.dr	Static PE information: Number of sections : 11 > 10
Source: pyarmor_runtime.pyd0.5.dr	Static PE information: Number of sections : 11 > 10
Source: pyarmor_runtime.pyd.5.dr	Static PE information: Number of sections : 11 > 10
Source: pyarmor_runtime.pyd0.0.dr	Static PE information: Number of sections : 11 > 10

Source: srloc.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: sapi.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: speechuxcpl.dll.mui0.0.dr	Static PE information: No import functions for PE file found
Source: SpeechUXRes.dll.0.dr	Static PE information: No import functions for PE file found
Source: speechuxcpl.dll.mui.5.dr	Static PE information: No import functions for PE file found
Source: SpeechUX.dll.mui0.5.dr	Static PE information: No import functions for PE file found
Source: sapi.dll.mui.5.dr	Static PE information: No import functions for PE file found
Source: SpeechUXWiz.exe.mui0.0.dr	Static PE information: No import functions for PE file found
Source: sapi.cpl.mui.5.dr	Static PE information: No import functions for PE file found
Source: srloc.dll.mui.5.dr	Static PE information: No import functions for PE file found
Source: SpeechUX.dll.mui0.0.dr	Static PE information: No import functions for PE file found
Source: SpeechUXWiz.exe.mui.0.dr	Static PE information: No import functions for PE file found
Source: SpeechUX.dll.mui.5.dr	Static PE information: No import functions for PE file found
Source: SpeechUXRes.dll.5.dr	Static PE information: No import functions for PE file found
Source: SpeechUX.dll.mui.0.dr	Static PE information: No import functions for PE file found
Source: sapi.cpl.mui.0.dr	Static PE information: No import functions for PE file found
Source: SpeechUXWiz.exe.mui.5.dr	Static PE information: No import functions for PE file found
Source: speechuxcpl.dll.mui0.5.dr	Static PE information: No import functions for PE file found
Source: SpeechUXWiz.exe.mui0.5.dr	Static PE information: No import functions for PE file found
Source: speechuxcpl.dll.mui.0.dr	Static PE information: No import functions for PE file found

Source: datasett.exe	Binary or memory string: OriginalFilename vs datasett.exe
Source: datasett.exe, 00000000.00000003.1674020513.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamespsreng.dllj% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1667992268.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs datasett.exe
Source: datasett.exe, 00000000.00000003.1672913711.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs datasett.exe
Source: datasett.exe, 00000000.00000003.1674699694.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesrloc.dllj% vs datasett.exe
Source: datasett.exe, 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAlterVoiceStudio.exeD vs datasett.exe
Source: datasett.exe, 00000000.00000003.1667214039.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs datasett.exe
Source: datasett.exe, 00000000.00000003.1672614789.000002CBEB84F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs datasett.exe
Source: datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs datasett.exe
Source: datasett.exe, 00000000.00000003.1673033158.000002CBEB855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32event.pyd0 vs datasett.exe
Source: datasett.exe, 00000000.00000003.1676889875.000002CBEB84B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpeechUXWiz.exe.muij% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1676960490.000002CBEB856000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSapi.cpl.muij% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1673033158.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32event.pyd0 vs datasett.exe
Source: datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs datasett.exe
Source: datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs datasett.exe
Source: datasett.exe, 00000000.00000003.1668598107.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs datasett.exe
Source: datasett.exe, 00000000.00000003.1673844624.000002CBEB84B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesrloc.dll.muij% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs datasett.exe
Source: datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs datasett.exe
Source: datasett.exe, 00000000.00000003.1677122523.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpeechUX.dll.muij% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1677326922.000002CBEB84B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSPEECHUXCPL.DLL.MUIr) vs datasett.exe
Source: datasett.exe, 00000000.00000003.1673150638.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesapi.dll.muij% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1676047096.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpeechDesktopPS.dllj% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs datasett.exe
Source: datasett.exe, 00000000.00000003.1677039105.000002CBEB856000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSapi.cpl.muij% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs datasett.exe
Source: datasett.exe, 00000000.00000003.1676344044.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpeechUX.dll.muij% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1676960490.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSapi.cpl.muij% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1677053962.000002CBEB84B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSPEECHUXCPL.DLL.MUIj% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1676889875.000002CBEB84D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpeechUXWiz.exe.muij% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1677235733.000002CBEB84B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpeechUXWiz.exe.muij% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1667583401.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs datasett.exe
Source: datasett.exe, 00000000.00000003.1675507745.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpTip.dllj% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1674537321.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamespsrx.dllj% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1672316104.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes39.dll0 vs datasett.exe
Source: datasett.exe, 00000000.00000003.1667361976.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs datasett.exe
Source: datasett.exe, 00000000.00000003.1674987749.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSTTSEngine.dllN vs datasett.exe
Source: datasett.exe, 00000000.00000003.1677235733.000002CBEB84D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpeechUXWiz.exe.muij% vs datasett.exe
Source: datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs datasett.exe
Source: datasett.exe, 00000000.00000003.1675300626.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSTTSLoc.dllN vs datasett.exe
Source: datasett.exe	Binary or memory string: OriginalFilename vs datasett.exe
Source: datasett.exe, 00000001.00000002.2916944161.00007FFE11EDD000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs datasett.exe
Source: datasett.exe, 00000001.00000002.2916484664.00007FFE11524000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs datasett.exe
Source: datasett.exe, 00000001.00000002.2916800351.00007FFE11EAF000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs datasett.exe
Source: datasett.exe, 00000001.00000002.2917100720.00007FFE120C6000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs datasett.exe
Source: datasett.exe, 00000001.00000002.2915584144.00007FFDFB75F000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython39.dll. vs datasett.exe
Source: datasett.exe, 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAlterVoiceStudio.exeD vs datasett.exe
Source: datasett.exe, 00000001.00000002.2917498541.00007FFE13313000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs datasett.exe
Source: datasett.exe, 00000001.00000002.2916154228.00007FFE0EB66000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs datasett.exe
Source: datasett.exe, 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs datasett.exe
Source: datasett.exe, 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs datasett.exe
Source: datasett.exe, 00000001.00000002.2917610398.00007FFE148E7000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs datasett.exe
Source: datasett.exe, 00000001.00000002.2916349751.00007FFE10314000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs datasett.exe
Source: datasett.exe, 00000001.00000002.2917387043.00007FFE130C6000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs datasett.exe
Source: datasett.exe, 00000001.00000002.2916584856.00007FFE117E9000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs datasett.exe
Source: datasett.exe, 00000001.00000002.2916679572.00007FFE11BB9000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: OriginalFilenamewin32event.pyd0 vs datasett.exe
Source: datasett.exe, 00000001.00000002.2915877295.00007FFE0E151000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs datasett.exe
Source: datasett.exe, 00000001.00000002.2915732229.00007FFE0147A000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenamelibsslH vs datasett.exe
Source: datasett.exe, 00000001.00000002.2917807888.00007FFE1A487000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs datasett.exe
Source: datasett.exe, 00000001.00000002.2916001037.00007FFE0E181000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: OriginalFilenamepywintypes39.dll0 vs datasett.exe
Source: datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs datasett.exe
Source: datasett.exe, 00000005.00000003.1734914929.000001D3521DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpeechUXWiz.exe.muij% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1716634961.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs datasett.exe
Source: datasett.exe, 00000005.00000003.1729771015.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSTTSEngine.dllN vs datasett.exe
Source: datasett.exe, 00000005.00000003.1730118682.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSTTSLoc.dllN vs datasett.exe
Source: datasett.exe, 00000005.00000003.1734540252.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSapi.cpl.muij% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1729432259.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesrloc.dllj% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1735086002.000001D3521DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSPEECHUXCPL.DLL.MUIr) vs datasett.exe
Source: datasett.exe, 00000005.00000003.1716510320.000001D3521D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs datasett.exe
Source: datasett.exe, 00000005.00000000.1715429033.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAlterVoiceStudio.exeD vs datasett.exe
Source: datasett.exe, 00000005.00000003.1727990973.000001D3521E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32event.pyd0 vs datasett.exe
Source: datasett.exe, 00000005.00000003.1734540252.000001D3521E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSapi.cpl.muij% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1716730085.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs datasett.exe
Source: datasett.exe, 00000005.00000003.1734368031.000001D3521DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpeechUXWiz.exe.muij% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1727098761.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes39.dll0 vs datasett.exe
Source: datasett.exe, 00000005.00000003.1733652317.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpeechUX.dll.muij% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1727990973.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32event.pyd0 vs datasett.exe
Source: datasett.exe, 00000005.00000003.1734368031.000001D3521DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpeechUXWiz.exe.muij% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1729263501.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamespsrx.dllj% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1728763769.000001D3521DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesrloc.dll.muij% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1718158484.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs datasett.exe
Source: datasett.exe, 00000005.00000003.1734761939.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpeechUX.dll.muij% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1728939437.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamespsreng.dllj% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1721207686.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs datasett.exe
Source: datasett.exe, 00000005.00000003.1722195369.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs datasett.exe
Source: datasett.exe, 00000005.00000003.1730534935.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpTip.dllj% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1734663614.000001D3521DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSPEECHUXCPL.DLL.MUIj% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1720689626.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs datasett.exe
Source: datasett.exe, 00000005.00000003.1727515209.000001D3521DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs datasett.exe
Source: datasett.exe, 00000005.00000003.1727863582.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs datasett.exe
Source: datasett.exe, 00000005.00000003.1731666439.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpeechDesktopPS.dllj% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1734642486.000001D3521E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSapi.cpl.muij% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1717756841.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs datasett.exe
Source: datasett.exe, 00000005.00000003.1734914929.000001D3521DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpeechUXWiz.exe.muij% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1721765801.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs datasett.exe
Source: datasett.exe, 00000005.00000003.1721954880.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs datasett.exe
Source: datasett.exe, 00000005.00000003.1728126740.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesapi.dll.muij% vs datasett.exe
Source: datasett.exe, 00000005.00000003.1722333278.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs datasett.exe
Source: datasett.exe, 00000005.00000003.1727282533.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs datasett.exe
Source: datasett.exe	Binary or memory string: OriginalFilename vs datasett.exe
Source: datasett.exe, 00000006.00000002.1760848787.00007FFE0CFB4000.00000002.00000001.01000000.00000021.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs datasett.exe
Source: datasett.exe, 00000006.00000000.1738888571.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAlterVoiceStudio.exeD vs datasett.exe
Source: datasett.exe, 00000006.00000003.1743133519.000002884E370000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs datasett.exe
Source: datasett.exe, 00000006.00000002.1760707760.00007FFE0CF86000.00000002.00000001.01000000.0000002B.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs datasett.exe
Source: datasett.exe, 00000006.00000002.1760610520.00007FFE0C0BF000.00000002.00000001.01000000.00000024.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs datasett.exe
Source: datasett.exe, 00000006.00000002.1759792495.00007FFE001C1000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: OriginalFilenamepywintypes39.dll0 vs datasett.exe
Source: datasett.exe, 00000006.00000002.1759590870.00007FFDFBAC1000.00000002.00000001.01000000.00000028.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs datasett.exe
Source: datasett.exe, 00000006.00000002.1759366858.00007FFDFAE6F000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: OriginalFilenamepython39.dll. vs datasett.exe
Source: datasett.exe, 00000006.00000002.1760517859.00007FFE0C0A9000.00000002.00000001.01000000.0000002C.sdmp	Binary or memory string: OriginalFilenamewin32event.pyd0 vs datasett.exe
Source: datasett.exe, 00000006.00000002.1760322676.00007FFE014D4000.00000002.00000001.01000000.00000029.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs datasett.exe
Source: datasett.exe, 00000006.00000002.1761643586.00007FFE101E7000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs datasett.exe
Source: datasett.exe, 00000006.00000002.1758860580.00007FFDFAA17000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs datasett.exe
Source: datasett.exe, 00000006.00000002.1759686551.00007FFE00191000.00000002.00000001.01000000.0000002F.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs datasett.exe
Source: datasett.exe, 00000006.00000002.1760950584.00007FFE0CFDD000.00000002.00000001.01000000.0000001C.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs datasett.exe
Source: datasett.exe, 00000006.00000002.1761822873.00007FFE10236000.00000002.00000001.01000000.00000025.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs datasett.exe
Source: datasett.exe, 00000006.00000002.1760423174.00007FFE0B2C9000.00000002.00000001.01000000.0000002E.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs datasett.exe
Source: datasett.exe, 00000006.00000002.1760185978.00007FFE013CA000.00000002.00000001.01000000.00000023.sdmp	Binary or memory string: OriginalFilenamelibsslH vs datasett.exe
Source: datasett.exe, 00000006.00000002.1761222692.00007FFE0EB33000.00000002.00000001.01000000.0000001F.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs datasett.exe
Source: datasett.exe, 00000006.00000002.1759911027.00007FFE00756000.00000002.00000001.01000000.0000002A.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs datasett.exe
Source: datasett.exe, 00000006.00000002.1761977331.00007FFE11077000.00000002.00000001.01000000.00000020.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs datasett.exe
Source: datasett.exe	Binary or memory string: OriginalFilenameAlterVoiceStudio.exeD vs datasett.exe

Source: classification engine

Classification label: mal76.evad.winEXE@11/104@1/1

Source: C:\Users\user\Desktop\datasett.exe

Code function: 0_2_00007FF7996774B0 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF7996774B0

Source: C:\Users\user\Desktop\datasett.exe

Code function: 6_2_00007FFE00174DD0 _Py_NoneStruct,_PyArg_ParseTuple_SizeT,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,GetDiskFreeSpaceW,PyEval_RestoreThread,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_BuildValue_SizeT,

6_2_00007FFE00174DD0

Source: C:\Users\user\Desktop\datasett.exe

Code function: 6_2_00007FFE0017CC40 _PyArg_ParseTuple_SizeT,?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z,?PyWinObject_AsResourceId@@YAHPEAU_object@@PEAPEA_WH@Z,?PyWinObject_AsResourceId@@YAHPEAU_object@@PEAPEA_WH@Z,FindResourceExW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,SizeofResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,LoadResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,LockResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,?PyWinObject_FreeResourceId@@YAXPEA_W@Z,?PyWinObject_FreeResourceId@@YAXPEA_W@Z,

6_2_00007FFE0017CC40

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1448:120:WilError_03
Source: C:\Users\user\Desktop\datasett.exe	Mutant created: \Sessions\1\BaseNamedObjects\Progaxxx82

Source: C:\Users\user\Desktop\datasett.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI68642

Jump to behavior

Source: datasett.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\datasett.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: datasett.exe

ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\datasett.exe

File read: C:\Users\user\Desktop\datasett.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\datasett.exe "C:\Users\user\Desktop\datasett.exe"
Source: C:\Users\user\Desktop\datasett.exe	Process created: C:\Users\user\Desktop\datasett.exe "C:\Users\user\Desktop\datasett.exe"
Source: C:\Users\user\Desktop\datasett.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /sc MINUTE /mo 15 /tn "VirboUpd" /tr "C:\Users\user\Desktop\datasett.exe" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc MINUTE /mo 15 /tn "VirboUpd" /tr "C:\Users\user\Desktop\datasett.exe" /f
Source: unknown	Process created: C:\Users\user\Desktop\datasett.exe C:\Users\user\Desktop\datasett.exe
Source: C:\Users\user\Desktop\datasett.exe	Process created: C:\Users\user\Desktop\datasett.exe C:\Users\user\Desktop\datasett.exe
Source: C:\Users\user\Desktop\datasett.exe	Process created: C:\Users\user\Desktop\datasett.exe "C:\Users\user\Desktop\datasett.exe"	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /sc MINUTE /mo 15 /tn "VirboUpd" /tr "C:\Users\user\Desktop\datasett.exe" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc MINUTE /mo 15 /tn "VirboUpd" /tr "C:\Users\user\Desktop\datasett.exe" /f	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Process created: C:\Users\user\Desktop\datasett.exe C:\Users\user\Desktop\datasett.exe	Jump to behavior

Source: C:\Users\user\Desktop\datasett.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: pywintypes39.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: pywintypes39.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\datasett.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: datasett.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: datasett.exe

Static file information: File size 11185705 > 1048576

Source: datasett.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: datasett.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: datasett.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: datasett.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: datasett.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: datasett.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: datasett.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: datasett.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb## source: _decimal.pyd.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-39\Release\win32event.pdb source: datasett.exe, 00000000.00000003.1673033158.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2916641506.00007FFE11BB5000.00000002.00000001.01000000.00000016.sdmp, datasett.exe, 00000005.00000003.1727990973.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1760479789.00007FFE0C0A5000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdbMM source: datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2916066006.00007FFE0EB5D000.00000002.00000001.01000000.00000014.sdmp, datasett.exe, 00000005.00000003.1721207686.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1759850177.00007FFE0074D000.00000002.00000001.01000000.0000002A.sdmp, _lzma.pyd.5.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\select.pdb source: datasett.exe, 00000000.00000003.1672434725.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2917570393.00007FFE148E4000.00000002.00000001.01000000.0000000A.sdmp, datasett.exe, 00000005.00000003.1727282533.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1761926164.00007FFE11074000.00000002.00000001.01000000.00000020.sdmp, select.pyd.5.dr, select.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_uuid.pdb source: datasett.exe, 00000000.00000003.1668777531.000002CBEB845000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2917028198.00007FFE120C3000.00000002.00000001.01000000.00000015.sdmp, datasett.exe, 00000005.00000003.1722333278.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1760668819.00007FFE0CF83000.00000002.00000001.01000000.0000002B.sdmp, _uuid.pyd.0.dr
Source:	Binary string: MSTTSLoc.pdbGCTL source: MSTTSLoc.dll.0.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: datasett.exe, 00000001.00000002.2915687874.00007FFE01445000.00000002.00000001.01000000.0000000D.sdmp, datasett.exe, 00000006.00000002.1760119655.00007FFE01395000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_bz2.pdb source: datasett.exe, 00000000.00000003.1667482511.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2916312250.00007FFE1030E000.00000002.00000001.01000000.00000013.sdmp, datasett.exe, 00000005.00000003.1716730085.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1760283252.00007FFE014CE000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: datasett.exe, 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmp, datasett.exe, 00000006.00000002.1758697606.00007FFDFA91F000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: SpeechUX.pdb source: SpeechUX.dll.5.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_queue.pdb source: datasett.exe, 00000000.00000003.1668412980.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2917339362.00007FFE130C3000.00000002.00000001.01000000.0000000F.sdmp, datasett.exe, 00000005.00000003.1721765801.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1761741700.00007FFE10233000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_ssl.pdb source: datasett.exe, 00000001.00000002.2916407431.00007FFE1150D000.00000002.00000001.01000000.0000000B.sdmp, datasett.exe, 00000006.00000002.1760767373.00007FFE0CF9D000.00000002.00000001.01000000.00000021.sdmp, _ssl.pyd.5.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-39\Release\win32api.pdb!! source: datasett.exe, 00000001.00000002.2915837657.00007FFE0E143000.00000002.00000001.01000000.00000019.sdmp, datasett.exe, 00000006.00000002.1759648415.00007FFE00183000.00000002.00000001.01000000.0000002F.sdmp, win32api.pyd.0.dr, win32api.pyd.5.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_hashlib.pdb source: datasett.exe, 00000000.00000003.1668128706.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2916749884.00007FFE11EA7000.00000002.00000001.01000000.0000000E.sdmp, datasett.exe, 00000005.00000003.1720689626.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1760572192.00007FFE0C0B7000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: SpTip.pdbGCTL source: datasett.exe, 00000000.00000003.1675507745.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1730534935.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\a01\_work\4\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: datasett.exe, 00000000.00000003.1667361976.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2916545747.00007FFE117E5000.00000002.00000001.01000000.00000018.sdmp, datasett.exe, 00000005.00000003.1716634961.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1760381109.00007FFE0B2C5000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdb source: datasett.exe, 00000000.00000003.1668275108.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2916066006.00007FFE0EB5D000.00000002.00000001.01000000.00000014.sdmp, datasett.exe, 00000005.00000003.1721207686.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1759850177.00007FFE0074D000.00000002.00000001.01000000.0000002A.sdmp, _lzma.pyd.5.dr
Source:	Binary string: in32event.pdb source: datasett.exe
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: datasett.exe, 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmp, datasett.exe, 00000006.00000002.1758697606.00007FFDFA91F000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: d:\a01\_work\4\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: datasett.exe, 00000000.00000003.1667214039.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2917766399.00007FFE1A481000.00000002.00000001.01000000.00000005.sdmp, datasett.exe, 00000005.00000003.1716510320.000001D3521D3000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1761534002.00007FFE101E1000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-39\Release\pywintypes.pdb** source: datasett.exe, 00000001.00000002.2915941722.00007FFE0E170000.00000002.00000001.01000000.00000017.sdmp, datasett.exe, 00000006.00000002.1759754239.00007FFE001B0000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: SpeechUX.pdbGCTL source: SpeechUX.dll.5.dr
Source:	Binary string: MSTTSLoc.pdb source: MSTTSLoc.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_ctypes.pdb source: datasett.exe, 00000001.00000002.2916894677.00007FFE11ED1000.00000002.00000001.01000000.00000006.sdmp, datasett.exe, 00000006.00000002.1760911705.00007FFE0CFD1000.00000002.00000001.01000000.0000001C.sdmp, _ctypes.pyd.5.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-39\Release\win32api.pdb source: datasett.exe, 00000001.00000002.2915837657.00007FFE0E143000.00000002.00000001.01000000.00000019.sdmp, datasett.exe, 00000006.00000002.1759648415.00007FFE00183000.00000002.00000001.01000000.0000002F.sdmp, win32api.pyd.0.dr, win32api.pyd.5.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: datasett.exe, 00000001.00000002.2915687874.00007FFE01445000.00000002.00000001.01000000.0000000D.sdmp, datasett.exe, 00000006.00000002.1760119655.00007FFE01395000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: SpeechUXPS.pdbGCTL source: datasett.exe, 00000000.00000003.1676047096.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1731666439.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_socket.pdb source: datasett.exe, 00000000.00000003.1668493540.000002CBEB844000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2917454297.00007FFE13309000.00000002.00000001.01000000.00000009.sdmp, datasett.exe, 00000005.00000003.1721954880.000001D3521D4000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1761102081.00007FFE0EB29000.00000002.00000001.01000000.0000001F.sdmp, _socket.pyd.5.dr, _socket.pyd.0.dr
Source:	Binary string: SpTip.pdb source: datasett.exe, 00000000.00000003.1675507745.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1730534935.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-39\Release\pywintypes.pdb source: datasett.exe, 00000001.00000002.2915941722.00007FFE0E170000.00000002.00000001.01000000.00000017.sdmp, datasett.exe, 00000006.00000002.1759754239.00007FFE001B0000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\unicodedata.pdb source: datasett.exe, 00000000.00000003.1672614789.000002CBEB84F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmp, datasett.exe, 00000005.00000003.1727515209.000001D3521DE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1759427402.00007FFDFBABB000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\python39.pdb source: datasett.exe, 00000001.00000002.2915271158.00007FFDFB643000.00000002.00000001.01000000.00000004.sdmp, datasett.exe, 00000006.00000002.1759072943.00007FFDFAD53000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: SpeechUXPS.pdb source: datasett.exe, 00000000.00000003.1676047096.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1731666439.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: datasett.exe, 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmp, datasett.exe, 00000006.00000002.1758697606.00007FFDFA9A1000.00000002.00000001.01000000.00000022.sdmp

Source: datasett.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: datasett.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: datasett.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: datasett.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: datasett.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: sapi.dll.0.dr

Static PE information: 0xFDA8E98A [Sun Nov 9 20:24:42 2104 UTC]

Source: C:\Users\user\Desktop\datasett.exe

Code function: 1_2_61B01CC0 LoadLibraryA,GetProcAddress,GetCurrentThread,

1_2_61B01CC0

Source: pywintypes39.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x224d8
Source: pyarmor_runtime.pyd.0.dr	Static PE information: real checksum: 0xa6f9d should be: 0x9903e
Source: win32api.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x303a5
Source: win32event.pyd.5.dr	Static PE information: real checksum: 0x0 should be: 0x76e6
Source: md__mypyc.cp39-win_amd64.pyd.5.dr	Static PE information: real checksum: 0x0 should be: 0x2a468
Source: pyarmor_runtime.pyd0.5.dr	Static PE information: real checksum: 0xa6f9d should be: 0x9903e
Source: pywintypes39.dll.5.dr	Static PE information: real checksum: 0x0 should be: 0x224d8
Source: pyarmor_runtime.pyd.5.dr	Static PE information: real checksum: 0xa6f9d should be: 0x9903e
Source: win32event.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x76e6
Source: win32api.pyd.5.dr	Static PE information: real checksum: 0x0 should be: 0x303a5
Source: pyarmor_runtime.pyd0.0.dr	Static PE information: real checksum: 0xa6f9d should be: 0x9903e
Source: md__mypyc.cp39-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x2a468
Source: md.cp39-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xa859
Source: md.cp39-win_amd64.pyd.5.dr	Static PE information: real checksum: 0x0 should be: 0xa859

Source: datasett.exe	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: sapi.dll.0.dr	Static PE information: section name: .didat
Source: SpeechUX.dll.0.dr	Static PE information: section name: .didat
Source: speechuxcpl.dll.0.dr	Static PE information: section name: .didat
Source: pyarmor_runtime.pyd.0.dr	Static PE information: section name: .xdata
Source: pyarmor_runtime.pyd0.0.dr	Static PE information: section name: .xdata
Source: speechuxcpl.dll.5.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.5.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.5.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.5.dr	Static PE information: section name: .00cfg
Source: sapi.dll.5.dr	Static PE information: section name: .didat
Source: SpeechUX.dll.5.dr	Static PE information: section name: .didat
Source: pyarmor_runtime.pyd.5.dr	Static PE information: section name: .xdata
Source: pyarmor_runtime.pyd0.5.dr	Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF7996C10E4 push rcx; retn 0000h	0_2_00007FF7996C10ED
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF7996C10CC push rbp; retn 0000h	0_2_00007FF7996C10CD
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF7996C10E4 push rcx; retn 0000h	1_2_00007FF7996C10ED
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF7996C10CC push rbp; retn 0000h	1_2_00007FF7996C10CD

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\datasett.exe	Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d	1_2_61B12260
Source: C:\Users\user\Desktop\datasett.exe	Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d	1_2_61B11EB0
Source: C:\Users\user\Desktop\datasett.exe	Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d	6_2_61B12260
Source: C:\Users\user\Desktop\datasett.exe	Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d	6_2_61B11EB0

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\datasett.exe	Process created: "C:\Users\user\Desktop\datasett.exe"
Source: C:\Users\user\Desktop\datasett.exe	Process created: C:\Users\user\Desktop\datasett.exe

Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUX.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\spsreng.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUXWiz.exe	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SpeechUXPS.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\TTS\MSTTSLoc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\en-US\srloc.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer\md.cp39-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32\pywintypes39.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\win32event.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\speechuxcpl.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\sapi.cpl.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\ru-RU\SpeechUXWiz.exe.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\python39.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Common\en-US\sapi.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\spsrx.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\SpeechUXWiz.exe.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\win32event.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\sapi.cpl	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUX.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUXWiz.exe.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Common\sapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\SpeechUXRes.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\spsreng.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\ru-RU\speechuxcpl.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\ru-RU\SpeechUXWiz.exe.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\charset_normalizer\md.cp39-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer\md__mypyc.cp39-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SPTIP.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\TTS\MSTTSEngine.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\python39.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\spsrx.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\TTS\MSTTSLoc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SpeechUXWiz.exe	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\speechuxcpl.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\en-US\srloc.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\SpeechUX.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\ru-RU\speechuxcpl.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\sapi.cpl	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\ru-RU\SpeechUX.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Common\sapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUXPS.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\speechuxcpl.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\srloc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Common\en-US\sapi.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\sapi.cpl.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SpeechUX.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\TTS\MSTTSEngine.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\charset_normalizer\md__mypyc.cp39-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUXRes.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\speechuxcpl.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SPTIP.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\pywin32_system32\pywintypes39.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\ru-RU\SpeechUX.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\srloc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\VCRUNTIME140.dll	Jump to dropped file

Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\sapi.cpl			Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\sapi.cpl			Jump to dropped file

Source: packs.sha256.5.dr

Binary or memory string: d8d4831a1bccbed23dca1847105b08745da677c852b05c5552a2651642ef4a3e en-US/bcdedit.exe.mui

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\datasett.exe	Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d	1_2_61B12260
Source: C:\Users\user\Desktop\datasett.exe	Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d	1_2_61B11EB0
Source: C:\Users\user\Desktop\datasett.exe	Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d	6_2_61B12260
Source: C:\Users\user\Desktop\datasett.exe	Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d	6_2_61B11EB0

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc MINUTE /mo 15 /tn "VirboUpd" /tr "C:\Users\user\Desktop\datasett.exe" /f

Source: C:\Users\user\Desktop\datasett.exe

Code function: 0_2_00007FF799673DF0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF799673DF0

Source: C:\Users\user\Desktop\datasett.exe

Code function: 1_2_00007FFDFAFC32F6 rdtsc

1_2_00007FFDFAFC32F6

Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUX.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\spsreng.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUXWiz.exe	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SpeechUXPS.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\TTS\MSTTSLoc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\en-US\srloc.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer\md.cp39-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\speechuxcpl.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\win32event.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\sapi.cpl.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\ru-RU\SpeechUXWiz.exe.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\python39.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Common\en-US\sapi.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\spsrx.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\win32event.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\SpeechUXWiz.exe.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\sapi.cpl	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUX.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Common\sapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUXWiz.exe.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\spsreng.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\SpeechUXRes.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\ru-RU\speechuxcpl.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\charset_normalizer\md.cp39-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\ru-RU\SpeechUXWiz.exe.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer\md__mypyc.cp39-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SPTIP.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\TTS\MSTTSEngine.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\python39.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\spsrx.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\TTS\MSTTSLoc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SpeechUXWiz.exe	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\speechuxcpl.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\en-US\srloc.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\sapi.cpl	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\ru-RU\speechuxcpl.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\SpeechUX.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\ru-RU\SpeechUX.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Common\sapi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUXPS.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\speechuxcpl.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\srloc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Common\en-US\sapi.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\sapi.cpl.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SpeechUX.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\TTS\MSTTSEngine.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\charset_normalizer\md__mypyc.cp39-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUXRes.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\speechuxcpl.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SPTIP.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\ru-RU\SpeechUX.dll.mui	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\srloc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68642\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\datasett.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI50522\_decimal.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\datasett.exe	API coverage: 2.9 %
Source: C:\Users\user\Desktop\datasett.exe	API coverage: 1.4 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF7996909B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7996909B4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799686714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF799686714
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799686714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF799686714
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799677820 FindFirstFileExW,FindClose,	0_2_00007FF799677820
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF7996909B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF7996909B4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799686714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF799686714
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799686714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF799686714
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799677820 FindFirstFileExW,FindClose,	1_2_00007FF799677820
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D3229 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,	6_2_00007FFDFA6D3229
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00173740 _PyArg_ParseTuple_SizeT,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyList_New,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindFirstFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyObject_FromWIN32_FIND_DATAW@@YAPEAU_object@@PEAU_WIN32_FIND_DATAW@@@Z,PyList_Append,_Py_Dealloc,FindNextFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindClose,_Py_Dealloc,	6_2_00007FFE00173740

Source: C:\Users\user\Desktop\datasett.exe

6_2_00007FFE001755D0

Source: C:\Users\user\Desktop\datasett.exe

Code function: 6_2_00007FFE0017FC68 VirtualQuery,GetSystemInfo,

6_2_00007FFE0017FC68

Source: datasett.exe, 00000000.00000003.1678475049.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1736892802.000001D3521D8000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: datasett.exe, 00000006.00000002.1755865343.000002884E32B000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753742679.000002884E325000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754885711.000002884E32A000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753458207.000002884E30D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW) --%SystemRoot%\system32\mswsock.dllableSequence.insertc
Source: datasett.exe, 00000000.00000003.1675300626.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1730118682.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, MSTTSLoc.dll.0.dr	Binary or memory string: .?AVCRegistryVirtualMachine@ATL@@
Source: datasett.exe	Binary or memory string: jqEMu
Source: datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: packs.sha256.5.dr	Binary or memory string: bb2f0ec2251002a1f4162013a2357425d1de8e69ab8ca122c2cefe54f5b24500 en-US/vmdebug.dll.mui
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D572C		6_2_00007FFDFA6D572C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D4241		6_2_00007FFDFA6D4241

Source: C:\Users\user\Desktop\datasett.exe

Code function: 1_2_00007FFDFAFC32F6 rdtsc

1_2_00007FFDFAFC32F6

Source: C:\Users\user\Desktop\datasett.exe

Code function: 0_2_00007FF799689AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF799689AE4

Source: C:\Users\user\Desktop\datasett.exe

Code function: 1_2_61B01CC0 LoadLibraryA,GetProcAddress,GetCurrentThread,

1_2_61B01CC0

Source: C:\Users\user\Desktop\datasett.exe

Code function: 0_2_00007FF7996925A0 GetProcessHeap,

0_2_00007FF7996925A0

Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF799689AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF799689AE4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF79967B69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF79967B69C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF79967AE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF79967AE00
Source: C:\Users\user\Desktop\datasett.exe	Code function: 0_2_00007FF79967B880 SetUnhandledExceptionFilter,	0_2_00007FF79967B880
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_61B7D400 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	1_2_61B7D400
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF799689AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF799689AE4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF79967B69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF79967B69C
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF79967AE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF79967AE00
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FF79967B880 SetUnhandledExceptionFilter,	1_2_00007FF79967B880
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAEA3310 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFAEA3310
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAEA2994 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFAEA2994
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAEA34F8 SetUnhandledExceptionFilter,	1_2_00007FFDFAEA34F8
Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC5A1F IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFAFC5A1F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_61B7D400 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	6_2_61B7D400
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D5A1F IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFDFA6D5A1F
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFB9B2994 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFDFB9B2994
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFB9B3310 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFDFB9B3310
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFB9B34F8 SetUnhandledExceptionFilter,	6_2_00007FFDFB9B34F8
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00180CBC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFE00180CBC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE001818C0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFE001818C0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00181AA8 SetUnhandledExceptionFilter,	6_2_00007FFE00181AA8
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE001AF8AC SetUnhandledExceptionFilter,	6_2_00007FFE001AF8AC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE001AE5AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFE001AE5AC
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE001AF6C4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFE001AF6C4
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00743CF8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFE00743CF8
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00743EE0 SetUnhandledExceptionFilter,	6_2_00007FFE00743EE0
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE00743374 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFE00743374
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01303818 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFE01303818
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFE01303250 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFE01303250

Source: C:\Users\user\Desktop\datasett.exe

Code function: 6_2_00007FFE0017DC70 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,keybd_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,

6_2_00007FFE0017DC70

Source: C:\Users\user\Desktop\datasett.exe

Code function: 6_2_00007FFE0017DD10 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,mouse_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,

6_2_00007FFE0017DD10

Source: C:\Users\user\Desktop\datasett.exe	Process created: C:\Users\user\Desktop\datasett.exe "C:\Users\user\Desktop\datasett.exe"	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /sc MINUTE /mo 15 /tn "VirboUpd" /tr "C:\Users\user\Desktop\datasett.exe" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc MINUTE /mo 15 /tn "VirboUpd" /tr "C:\Users\user\Desktop\datasett.exe" /f	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Process created: C:\Users\user\Desktop\datasett.exe C:\Users\user\Desktop\datasett.exe	Jump to behavior

Source: C:\Users\user\Desktop\datasett.exe

Code function: 6_2_00007FFE001A7D00 PyArg_ParseTuple,PyExc_TypeError,PyErr_SetString,GetSecurityDescriptorDacl,free,SetSecurityDescriptorDacl,GetSecurityDescriptorOwner,free,GetSecurityDescriptorGroup,free,free,free,

6_2_00007FFE001A7D00

Source: C:\Users\user\Desktop\datasett.exe

Code function: 6_2_00007FFE001A8B80 _PyArg_ParseTuple_SizeT,PyErr_Clear,_PyArg_ParseTuple_SizeT,PyErr_Clear,_PyArg_ParseTuple_SizeT,PySequence_Check,PyExc_TypeError,PyErr_SetString,PySequence_Size,PySequence_Tuple,_PyArg_ParseTuple_SizeT,_Py_Dealloc,AllocateAndInitializeSid,PyExc_ValueError,PyErr_SetString,_Py_NewReference,malloc,memset,memcpy,

6_2_00007FFE001A8B80

Source: SpeechUX.dll.5.dr

Binary or memory string: EnableFocusWarningMS:SpeechTopLevelProgmanWorkerWButtonShell_TrayWndSidebar_AppBarWindowSELECT TOP 10000 System.DateModified, System.ItemUrl, System.Search.AutoSummary FROM SystemIndex..scope() WHERE System.DateModified > '%d/%d/%d %d:%d:%d' and (System.ItemType = '.doc' or System.ItemType='.docx' or System.Message.MessageClass='MAPI/IPM.Note') and (NOT Contains(System.Shell.SFGAOFlagsStrings, 'hidden')) ORDER BY System.DateModifiedApplication=WindowsSearch.CollatorDSOfile:csc:file:/Row: %s, %s

Source: C:\Users\user\Desktop\datasett.exe

Code function: 0_2_00007FF7996989B0 cpuid

0_2_00007FF7996989B0

Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pyarmor_runtime_000000 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pyarmor_runtime_000000 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pyarmor_runtime_000000 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pyarmor_runtime_000000\pyarmor_runtime.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer\md.cp39-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer\md__mypyc.cp39-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\_uuid.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\win32event.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\certifi\cacert.pem VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\certifi\cacert.pem VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI68642\certifi\cacert.pem VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\Speech VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\pyarmor_runtime_000000 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\pyarmor_runtime_000000 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\pyarmor_runtime_000000 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\pyarmor_runtime_000000\pyarmor_runtime.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\Desktop\datasett.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\charset_normalizer\md.cp39-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\datasett.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI50522\charset_normalizer VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\datasett.exe

Code function: 0_2_00007FF79967B580 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF79967B580

Source: C:\Users\user\Desktop\datasett.exe

Code function: 6_2_00007FFE001743D0 _PyArg_ParseTuple_SizeT,GetUserNameW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,

6_2_00007FFE001743D0

Source: C:\Users\user\Desktop\datasett.exe

Code function: 0_2_00007FF799694E20 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF799694E20

Source: C:\Users\user\Desktop\datasett.exe

Code function: 6_2_00007FFE00177A20 _PyArg_ParseTuple_SizeT,GetVersion,_Py_BuildValue_SizeT,

6_2_00007FFE00177A20

Source: C:\Users\user\Desktop\datasett.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\datasett.exe	Code function: 1_2_00007FFDFAFC2B5D bind,WSAGetLastError,		1_2_00007FFDFAFC2B5D
Source: C:\Users\user\Desktop\datasett.exe	Code function: 6_2_00007FFDFA6D2B5D bind,WSAGetLastError,		6_2_00007FFDFA6D2B5D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	11 Input Capture	2 System Time Discovery	Remote Services	11 Input Capture	22 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	11 Bootkit	1 Scheduled Task/Job	12 Process Injection	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Bootkit	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	26 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
datasett.exe	34%	ReversingLabs	Win64.Adware.RedCap
datasett.exe	100%	Avira	TR/Redcap.xorcu

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Common\en-US\sapi.dll.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Common\sapi.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\en-US\srloc.dll.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\spsreng.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\spsrx.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\srloc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\TTS\MSTTSEngine.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\TTS\MSTTSLoc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SPTIP.DLL	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUX.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUXPS.DLL	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUXWiz.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUX.dll.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUXRes.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUXWiz.exe.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\sapi.cpl.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\speechuxcpl.dll.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\ru-RU\SpeechUX.dll.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\ru-RU\SpeechUXWiz.exe.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\ru-RU\speechuxcpl.dll.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\sapi.cpl	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\speechuxcpl.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\__init__.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\charset_normalizer\md.cp39-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\charset_normalizer\md__mypyc.cp39-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\pyarmor_runtime.pyd	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\pyarmor_runtime_000000\pyarmor_runtime.pyd	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\python39.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\pywin32_system32\pywintypes39.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\win32api.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI50522\win32event.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Common\en-US\sapi.dll.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Common\sapi.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\en-US\srloc.dll.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\spsreng.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\spsrx.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\srloc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\TTS\MSTTSEngine.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\TTS\MSTTSLoc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SPTIP.DLL	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SpeechUX.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SpeechUXPS.DLL	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SpeechUXWiz.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\SpeechUX.dll.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\SpeechUXRes.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\SpeechUXWiz.exe.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\sapi.cpl.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\speechuxcpl.dll.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\ru-RU\SpeechUX.dll.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\ru-RU\SpeechUXWiz.exe.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\ru-RU\speechuxcpl.dll.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\sapi.cpl	0%	ReversingLabs

Source	Detection	Scanner	Label
http://ocsp.accv.ese	0%	Avira URL Cloud	safe
http://ocsp.digif	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningspf	0%	Avira URL Cloud	safe
http://ocsp.digi	0%	Avira URL Cloud	safe
http://www.robotstxt.org/norobots-rfc.txt	0%	Avira URL Cloud	safe
http://repository.swisssign.com/a	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
iplogger.org	104.26.3.46	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://google.com/	datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1755830091.000002884E312000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753785930.000002884E30E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753458207.000002884E30D000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754788827.000002884E311000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	datasett.exe, 00000001.00000003.1685920181.000001CA0EAB7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1686004054.000001CA0EAF2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752494608.00000288508E2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754249502.00000288508EB000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752863410.00000288508EA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754753546.00000288508FE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1743252369.000002884E3C0000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1743133519.000002884E3BC000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754572349.00000288508EB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl	datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://.../back.jpeg	datasett.exe, 00000001.00000002.2913572705.000001CA11710000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1746646839.0000028850A1F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757882425.0000028850D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.python.org/download/releases/2.3/mro/.	datasett.exe, 00000001.00000003.1684836609.000001CA0EAF8000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912253685.000001CA10880000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684777469.000001CA0EAEC000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684695963.000001CA0EAEC000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684754877.000001CA0EAF8000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1742795678.000002884E3B6000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756347653.00000288502A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/mhammond/pywin32	datasett.exe, datasett.exe, 00000006.00000002.1759792495.00007FFE001C1000.00000002.00000001.01000000.0000002D.sdmp, datasett.exe, 00000006.00000002.1760517859.00007FFE0C0A9000.00000002.00000001.01000000.0000002C.sdmp, datasett.exe, 00000006.00000002.1759686551.00007FFE00191000.00000002.00000001.01000000.0000002F.sdmp, win32api.pyd.0.dr, win32api.pyd.5.dr	false		high
https://httpbin.org/post	datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1755865343.000002884E32B000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753742679.000002884E325000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754885711.000002884E32A000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753458207.000002884E30D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl0	datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.digif	datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Ousret/charset_normalizer	datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757421956.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.000002885095E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752786045.0000028850945000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753256581.0000028850946000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.accv.ese	datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.firmaprofesional.com/cps0	datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm9hxj	datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://python.org/dev/peps/pep-0263/	datasett.exe, 00000006.00000002.1759072943.00007FFDFAD53000.00000002.00000001.01000000.0000001A.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	datasett.exe, 00000001.00000003.1685920181.000001CA0EAB7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684134076.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680524631.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680369460.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683770842.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680369460.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680315220.000001CA0EADF000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683979233.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680192150.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684134076.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680524631.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683770842.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680684974.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680328707.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683979233.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683478506.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680684974.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683478506.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754037534.0000028850461000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	datasett.exe, 00000001.00000002.2913229256.000001CA11220000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757421956.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.0000028850955000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752786045.0000028850945000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753256581.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757792500.0000028850C40000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	datasett.exe, 00000001.00000002.2912355486.000001CA10AE3000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757421956.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1755060297.00000288508C7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.0000028850955000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754014840.00000288508C6000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752786045.0000028850945000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753256581.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753093881.000002884E39C000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752439883.000002884E347000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753503603.000002884E3A2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753676136.000002884E3AE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756028776.000002884E3B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://iplogger.org/Drop8VbLink	datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/uUbM2VAB__path__	datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1755318713.0000028850540000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1746858969.00000288504DD000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756677827.0000028850541000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753339807.000002885053F000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752759804.0000028850537000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/a	datasett.exe, 00000001.00000002.2912643746.000001CA10E85000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724156433.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/	datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752494608.00000288508E2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754249502.00000288508EB000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752863410.00000288508EA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754770494.00000288508F6000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754572349.00000288508EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://iplogger.org/Drop8otstuk	datasett.exe, 00000006.00000002.1756885684.00000288505F0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps0	datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	datasett.exe, 00000001.00000002.2912355486.000001CA10AE3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	datasett.exe, 00000001.00000002.2913158600.000001CA11190000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757734662.0000028850BB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/fn5bRN1F	datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	datasett.exe, 00000001.00000002.2913023346.000001CA11070000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757610535.0000028850A90000.00000004.00001000.00020000.00000000.sdmp	false		high
https://requests.readthedocs.io	datasett.exe, 00000006.00000002.1758039593.0000028850E10000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1755865343.000002884E32B000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753742679.000002884E325000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754885711.000002884E32A000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753458207.000002884E30D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	datasett.exe, 00000001.00000002.2913296015.000001CA112C0000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757849481.0000028850CE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.accv.es	datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crlerr	datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/	datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912643746.000001CA10E85000.00000004.00000020.00020000.00000000.sdmp	false		high
http://json.org	datasett.exe, 00000006.00000003.1754572349.00000288508EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	datasett.exe, 00000001.00000002.2913193358.000001CA111D0000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757764425.0000028850BF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	datasett.exe, 00000001.00000003.1685920181.000001CA0EAB7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684134076.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680369460.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680192150.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680524631.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683770842.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680684974.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912089151.000001CA102F0000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680328707.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683979233.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683478506.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756225617.0000028850060000.00000004.00001000.00020000.00000000.sdmp	false		high
https://httpbin.org/get	datasett.exe, 00000006.00000002.1758008992.0000028850DD0000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756488404.0000028850470000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752999911.00000288504DD000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754572349.00000288508EB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl	datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920p	datasett.exe, 00000006.00000002.1757792500.0000028850C40000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.python.org	datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1755865343.000002884E32B000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753742679.000002884E325000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754885711.000002884E32A000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753458207.000002884E30D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.robotstxt.org/norobots-rfc.txt	datasett.exe, 00000006.00000003.1754037534.0000028850461000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754075017.0000028850465000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754502410.000002885046D000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754328484.0000028850466000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756488404.0000028850470000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/uUbM2VAB	datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm0U	datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.digi	datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wwww.certigna.fr/autorites/0m	datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.accv.es0	datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	datasett.exe, 00000000.00000003.1669998758.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1724156433.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/	datasett.exe, 00000001.00000003.1685920181.000001CA0EAB7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1686004054.000001CA0EAF2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752494608.00000288508E2000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754249502.00000288508EB000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752863410.00000288508EA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754753546.00000288508FE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1743252369.000002884E3C0000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1743133519.000002884E3BC000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754572349.00000288508EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	datasett.exe, 00000001.00000003.1685920181.000001CA0EAB7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684134076.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680524631.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680369460.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683770842.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680369460.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680315220.000001CA0EADF000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683979233.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680192150.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684134076.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680524631.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683770842.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680684974.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680328707.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683979233.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683478506.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680684974.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683478506.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754037534.0000028850461000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.org?format=json	datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://httpbin.org/	datasett.exe, 00000006.00000003.1752439883.000002884E347000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/dev/peps/pep-0205/	datasett.exe, 00000000.00000003.1678160567.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912516810.000001CA10BD0000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000005.00000003.1736245775.000001D3521D8000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756885684.00000288505F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/	datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/	datasett.exe, 00000001.00000002.2912355486.000001CA10AE3000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757421956.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753093881.000002884E39C000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.0000028850955000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752786045.0000028850945000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753256581.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752439883.000002884E347000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps	datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	datasett.exe, 00000001.00000002.2912355486.000001CA10AE3000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1755081662.0000028850539000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1746858969.00000288504DD000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1755383513.0000028850539000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753649523.000002885088E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756677827.0000028850539000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752944599.0000028850874000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752759804.0000028850537000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	datasett.exe, 00000001.00000003.1685920181.000001CA0EAB7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684134076.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680524631.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680369460.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683770842.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680369460.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680315220.000001CA0EADF000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683979233.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680192150.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1684134076.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680524631.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683770842.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680684974.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680328707.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683979233.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683478506.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1680684974.000001CA0EAA9000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000003.1683478506.000001CA0EADA000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754037534.0000028850461000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/	datasett.exe, 00000006.00000003.1753256581.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752439883.000002884E347000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail/	datasett.exe, 00000006.00000003.1754433045.000002884E3C1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/mail/	datasett.exe, 00000001.00000002.2912355486.000001CA10AE3000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757216796.00000288508C0000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl	datasett.exe, 00000001.00000002.2912355486.000001CA10A40000.00000004.00000020.00020000.00000000.sdmp	false		high
http://wwwsearch.sf.net/):	datasett.exe, 00000001.00000002.2913343331.000001CA113A0000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757339264.0000028850934000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.0000028850924000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753139716.0000028850932000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1755344880.0000028850934000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751520665.0000028850915000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io/	datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/C1vS7y2X	datasett.exe, 00000001.00000002.2912481776.000001CA10B80000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1756812067.00000288505A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm	datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	datasett.exe, 00000001.00000002.2913193358.000001CA111D0000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757764425.0000028850BF0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/A	datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl0	datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.openssl.org/H	datasett.exe, 00000000.00000003.1670119905.000002CBEB848000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmp, datasett.exe, 00000001.00000002.2915732229.00007FFE0147A000.00000002.00000001.01000000.0000000D.sdmp, datasett.exe, 00000005.00000003.1724313754.000001D3521D7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1758860580.00007FFDFAA17000.00000002.00000001.01000000.00000022.sdmp, datasett.exe, 00000006.00000002.1760185978.00007FFE013CA000.00000002.00000001.01000000.00000023.sdmp	false		high
http://crl.certigna.fr/certignarootca.crl01	datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/	datasett.exe, 00000001.00000002.2912643746.000001CA10F31000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	datasett.exe, 00000001.00000002.2912355486.000001CA10AE3000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000001.00000002.2912643746.000001CA10D90000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757421956.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1755060297.00000288508C7000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.0000028850944000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1751322552.0000028850955000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754014840.00000288508C6000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752786045.0000028850945000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1753256581.0000028850946000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl$hxw	datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es00	datasett.exe, 00000001.00000002.2913343331.000001CA113D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	datasett.exe, 00000006.00000003.1754601960.000002884E349000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningspf	datasett.exe, 00000001.00000002.2913158600.000001CA11190000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://foss.heptapod.net/pypy/pypy/-/issues/3539	datasett.exe, 00000001.00000002.2913023346.000001CA11070000.00000004.00001000.00020000.00000000.sdmp, datasett.exe, 00000006.00000002.1757610535.0000028850A90000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	datasett.exe, 00000001.00000002.2911883602.000001CA0EA2E000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1754014840.00000288508C6000.00000004.00000020.00020000.00000000.sdmp, datasett.exe, 00000006.00000003.1752290953.00000288508BE000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.3.46	iplogger.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580468
Start date and time:	2024-12-24 16:46:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	datasett.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@11/104@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: datasett.exe

Simulations

Behavior and APIs

Time	Type	Description
15:47:01	Task Scheduler	Run new task: VirboUpd path: C:\Users\user\Desktop\datasett.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.3.46	W7ZBbzV7A5.exe	Get hash	malicious	Unknown	Browse
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig	Browse
	SecuriteInfo.com.Trojan.DownLoaderNET.786.26034.14743.exe	Get hash	malicious	Unknown	Browse
	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
iplogger.org	W7ZBbzV7A5.exe	Get hash	malicious	Unknown	Browse	104.26.3.46
	care.rtf	Get hash	malicious	Unknown	Browse	172.67.74.161
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	104.26.3.46
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	104.26.3.46
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.26.3.46
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.26.3.46
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.26.2.46
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	172.67.74.161
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	172.67.74.161
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	104.26.2.46

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://tb.ldpdljrr.ru/	Get hash	malicious	Unknown	Browse	104.21.30.230
	installer.msi	Get hash	malicious	Unknown	Browse	172.67.196.179
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.88.181
	badvbscript.html	Get hash	malicious	Unknown	Browse	1.1.1.1
	#U65b0#U5efa #U6587#U672c#U6587#U6863.ps1	Get hash	malicious	Unknown	Browse	172.67.201.143
	https://u48635528.ct.sendgrid.net/ls/click?upn=u001.9c3qucD-2BQzNTT0bmLRTJr37m0fhz0zdKJtvEO5GYL-2FheRuyVOh-2FQG4V3oBgBPYNynDxn_I1ksFJapfNmw0nKrksu71KTxdlg2CVrjzBUVofCtIEhaWkhL1Pph-2Ffg-2BCFbPvkCL9SX-2Fn-2BNBrku3RcjHS1atB8ladrmemt-2BtQU5680xhgoUl-2FmS0Bdj-2FOfednny-2F-2Bj2bwjjubeRvrpN0J7TGLD3CnNRzymiQOzypjCqxHhzmXtY2EWHJMJBxjl-2FHlyEIekWjEdTpTsRC8R5LaI-2BXF4kV8UeUtXxyFJLbYiR3fqcWt2evvBBECu9MeQj8TLZrmfuTf-2BJQraijp8-2BcIdxf8rnVxjHoJK1lo9-2Bkao444JbRSinVA-2FoUxeuAtdlrITU1Z6gHAn7DLZstY4XJkhkT16-2F2TN4CFt2LQ-2BEh9GWg4EPlocPi8ljTs-2B9D9RVbWdc3s2Vk2VPHSj20oCO3-2FalihBzGJuaYie5tnYaz6wBF3EqNzMXmVqRnMZwSYuGRwSMVhkchytYzt3hUH-2F51IUfn7nuhHUcUbdS8nBYneAMuB2eSDRn8IZzUkExLUascCVn8T9ImEyo0qhVsBPdJjfT9L3qli9clY1N-2BhQXDZgQnsN1Bs9PujeLzem37C62BvWnqPnqvXh5vbcvseiZwTP35DEJysw-3D-3D#mlyon@wc.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	vce exam simulator 2.2.1 crackk.exe	Get hash	malicious	LummaC	Browse	104.21.33.227
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.199.72
	j6ks0Fxu6t.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	wIgjKoo9iI.exe	Get hash	malicious	LummaC	Browse	104.21.36.201

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	3.560212102277829
Encrypted:	false
SSDEEP:	192:4LEUt5t468Uq0voq3qv/DX0k8QtrutqGW9uJq/6kqHt8NZrzW0NWL:qd8r026yruBW9VUt0ZrzW0NWL
MD5:	4D5B570C6A43917B52741B707341FDDA
SHA1:	010A9C83255E9271154280418BF601F975430DD9
SHA-256:	809AB1C72338B01C0DE9D7367E2763FCA896E0F6EC7E833F45DE45C3BC033134
SHA-512:	4A7767152DBF40F41F0CB7399E3040DA4AE4D33D2204468EC0DDC0CA9B60F3424E7DD489463AB227584DA31DB550537140E980B271B8D2F434265B3627971729
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........>...............................................`............@.......................................... ..D;..............................8............................................................................rdata..............................@..@.rsrc....@... ...<..................@..@.....>.........T...8...8........>.........$...................8....rdata..8...x....rdata$zzzdbg.... ..0....rsrc$01....0#..08...rsrc$02.... ...r..P....i....<.? =.Y.....W..>.........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Common\sapi.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1569792
Entropy (8bit):	6.1201506655739
Encrypted:	false
SSDEEP:	24576:7l085rs7VUKi682+npiLP82fIyL0/PcioZ:7qwsk1KLP82fI
MD5:	F977B1ED7C926A23C9993E0CD9822B8E
SHA1:	A90AB8D7D7F4C54829700700B210B17D63BA1F4D
SHA-256:	958A63EFC1D059A3F8699B6A2AE1D59A1898F948A7819CC886A946F1C0E6496F
SHA-512:	AEB28D8A69C7734F25DFF71B2715512122573EE05014A543054C8F79B8FD78E132BC1184069D7534F3073B121ADD245BDAC2AE7900E0637E1B8D3536E586F3C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Xh@.6;@.6;@.6;T.7:U.6;@.7;..6;T.5:K.6;T.2:.6;T.3:q.6;T.6:A.6;T.>:>.6;T..;A.6;T.4:A.6;Rich@.6;........PE..d................" .........................................................`.......~....`A.........................................:......$;.......p....................... ..l3......p.......................(................... ........8.......................text............................... ..`.rdata.. L.......N..................@..@.data...(X...`...4...J..............@....pdata...............~..............@..@.didat..p....`......................@....rsrc........p......................@..@.reloc..l3... ...4..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\en-US\srloc.dll.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.5855334678640385
Encrypted:	false
SSDEEP:	48:y+3B1xI/cY2gFQK44asIFOFYQaEVKZWPTHzawuGZ/AK5WwZHV:DUcYj2UOWPTuZUHWwb
MD5:	311C1AE96CA16A1F9C0F4857AB81BD2F
SHA1:	2FC721FD5E5CEDE54C6B598D0F473D61EB31F830
SHA-256:	F57D453C82D5CEEB269E28961241C5F027EC17F65E6D1E8A45229471DBB5476F
SHA-512:	EDB5961D57FD5C77CB57E1CDDE945BDF9C3A4753B96EDBAD6F890337BA9D32E29B80F94850593B3F08BAC4B5C1BCAF2B9FF8C4A891204C4720AE4A939EF39825
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........................................................0.......-....@.......................................... ..l...............................8............................................................................rdata..............................@..@.rsrc........ ......................@..@......)\........T...8...8.........)\........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....!.......rsrc$02.... ..._...Y ..9.h.._lG.\@.....@.c..)\........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\spsreng.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1073152
Entropy (8bit):	6.650667849531351
Encrypted:	false
SSDEEP:	24576:fAGx/PfINLsVkWOur35TgkvUnHNyop+1BwBBH:fBPgBHur356z
MD5:	FC3F513DBFA7AE54EF4E3498D9E9784B
SHA1:	3F29B2C3E1E34D3062B17525669CD3B6F82961A2
SHA-256:	67DF7281CE98F247F25427232785A8D651472E21488BF2CB4AB57CBAAB7BE016
SHA-512:	D9594815B4A71BA70E16AA26317D7C8D93171EF958F824FA99AB9F8EE15885940D44D47334A6CF4668BDD27C10B3044DB131D841ACAD631869E9D3853775F2CC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.b..y...y...y.......y...y...y.......y.......y......Oy.......y.......y......y.......y..Rich.y..........PE..d...4............." .....N...2......0b..............................................E.....`A................................................T...x................o.................. <..p...................x...(...`...................H............................text...,M.......N.................. ..`.rdata..\....`.......R..............@..@.data...............................@....pdata...o.......p..................@..@.rsrc................L..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\spsrx.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	105472
Entropy (8bit):	5.961405979583004
Encrypted:	false
SSDEEP:	3072:HGvgUUbeZWCkPhh7rnrwwFQIgplqiOPRcuwtB9N6f:mvgD7rnVQIgpl16otB9
MD5:	F3A75622E931E20DFFD1DAA951D71F39
SHA1:	B94BB09EB306B88972397B8AF555623F0655F086
SHA-256:	7B8F98BE4BD2145E4E1E4C71C6D2A1B789C6810F0582209502F4666A035B41C1
SHA-512:	6222714A9F2F37CB58577EDE6D8246C528488D878830313D3D84372F1DCE8C5B79CEF99C4AC5CF229F2366663F1BB1DC7B8855DCD234426CFA202E32A08E8330
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4..@4..@4..@ ..A?..@4..@A..@ ..A=..@ ..Az..@ ..A...@ ..A5..@ ..A;..@ .*@5..@ ..A5..@Rich4..@................PE..d...Kc+..........." .................p..............................................^.....`A........................................@&.......&..x........`...p..................T...`...p...........................0...............H................................text............................... ..`.rdata...P.......R..................@..@.data....#...@......................@....pdata.......p.......,..............@..@.rsrc....`.......b...6..............@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\srloc.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	486400
Entropy (8bit):	6.223693489277457
Encrypted:	false
SSDEEP:	12288:eQnZiz8HurXkIvbEoQwHG7jeCYtpEo7Tf:eQn/urXzzEtNopH7T
MD5:	29BB9B5D6EFA4A639759E59641AA5821
SHA1:	DC6E55DDB6F5C5061F48238E4AEC290E26EC7804
SHA-256:	F373673D34CC74F76F8C951B664589845B9DD82C939F6973C67E8FFF7D6F9840
SHA-512:	5E9D38856FA39F7F9221BCA2C9FDB72E62590D9544E9446CD76AD983FD4454885E52DACCFE8E1A71F1CBEAAC1BA23E981B051FB89819532698AF0AA20E15D65E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........c.M..[M..[M..[D.[O..[Y..ZF..[M..[..[Y..ZA..[Y..Z..[Y..Z...[Y..ZL..[Y..Z/..[Y..[L..[Y..ZL..[RichM..[........PE..d...j............." .................,...............................................o....`A................................................t...........8....`..P...............x......p...................x7..(...`6...............7..`............................text............................... ..`.rdata..............................@..@.data...._.......>..................@....pdata..P....`...0..."..............@..@.rsrc...8............R..............@..@.reloc..x............X..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\TTS\MSTTSEngine.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1011072
Entropy (8bit):	6.305825051822925
Encrypted:	false
SSDEEP:	24576:60Ys17BeFoRnCANrxjmao8OC7VM5s4sJQ10c1pSCLiXt3juk1vcMmLglSuCJ:ldF8FCCyrxjmatrV0sQ0cKmQBTM1
MD5:	F9512C058964F125C0C0883C0CCA225E
SHA1:	F5BE9E7DECF8A6BFAD3411FF8AE15E8F40405215
SHA-256:	41CE9B38D03E80088A744C13229CAB4BC4CC9FBCF60C0E553A8E66EA8F9B07A4
SHA-512:	1CE62154B0DBB0C4C55F7BD87C97877FEBD2CE59F8FACFB2C10D38F7F0968D3350B279A6D6853E71097093728120415DFDCE54D169819A789CA65A6A453A639D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Iu.....T...T...T.lBT...T...U...T...U...T...T...T...U...T...U...T...U...T...U%..T...T...T...U...TRich...T........................PE..d......n.........." ......................................................................`A................................................x...........8w.......g...H...%...p..@.......p...........................0)..............H*...............................text............................... ..`.rdata...`.......b..................@..@.data...@V... ...N..................@....pdata...g.......h...L..............@..@.rsrc...8w.......x..................@..@.reloc..@....p.......,..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\TTS\MSTTSLoc.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	521728
Entropy (8bit):	5.26816086887833
Encrypted:	false
SSDEEP:	6144:ZhyW3FrJhNl7y10hwkxJ7HNfS3GtsLtQNnzs4G8thhqsNYcoCfgISw:KW3F1Xl7ykxxt94b2hhqKYcngIS
MD5:	40EB1F198A18021833E65A076955B03C
SHA1:	730F666A44942AD4BA59C69948036C57B5DB9827
SHA-256:	4ED0E11DF812CD586423182568E2F28B3DBA92F85B5FDA68351BF97468083079
SHA-512:	70C9514587B81EE9A744234F5A5AFA1FBADB1DF4E457D7A47B304736240B60320B330A655F7A9F907247A049C134B3B488AF9898ACE8263026F83C745006DD35
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Xc.s... ... ... .z. ... .i.!... .i.!... ... ... .i.!... .i.!... .i.!... .i.!... .ii ... .i.!... Rich... ........................PE..d...D..".........." .........N...............................................0............`A............................................P.......................L)..............@>...k..p...........................P...............h................................text... ........................... ..`.rdata...2.......4..................@..@.data...............................@....pdata..L).......*..................@..@.rsrc...............................@..@.reloc..@>.......@..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SPTIP.DLL

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159232
Entropy (8bit):	6.141294435501823
Encrypted:	false
SSDEEP:	3072:wFp5C2mYK1JVOaFXlEbfIfhvIAG7+lyXOzt+ikzN:kp5CasO+1EjIfhvI/eyXy52N
MD5:	C4D73A4379E6F55F698532ECBC9579BE
SHA1:	FB53B40E6BEC2AEBB0BA97D86FE1D3C7CCE94D94
SHA-256:	683F604AD40AB82382809D75595F734B672FAC75E1E8EF63C94683D11C848D6D
SHA-512:	1AF8F089F4CCB67ADAB896AB7C0B23D69D3BEEB493E719FBEF55B507295CCDA7E7343D59504102433D02EA800C7FDEDFECE4252C36514537C52BD35FC067E8E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[\~..=...=...=...V...=...V...=...=...=...V...=...V...=...V...=...V...=...V..=...V...=..Rich.=..........PE..d... <............" ................0...............................................k.....`A................................................D........@...C...0..........................p...............................................p............................text............................... ..`.rdata..JN.......P..................@..@.data...x.... ......................@....pdata.......0......................@..@.rsrc....C...@...D...&..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUX.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1453568
Entropy (8bit):	6.7106066470226216
Encrypted:	false
SSDEEP:	24576:lwcdUsNWUncNv/WwMri3RtZDJK3e86Lq2i1Sj57nyTTHmdR9adKn0ox8oLg:lrOsNtme5yPAe8GVjlnwy0dM0QLg
MD5:	6BFEF5D4BA0C93C0BCE2593BAC58015C
SHA1:	B03839587DC0CAD96277E0621850D6B151CF90A6
SHA-256:	A7E2602CE3D1093712D316497D887D0C97A9738EDC026726055BF07572D84099
SHA-512:	EDECCB0697F8CD7EAAF6E96AF783B328278AA53C02CF08A64403C3D04738CD0DC0746B726ECD010023F17B07DCDD1EA8B6BB47F7C122BC413D5A977AF20B2810
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s3...`...`...`...a...`...a...`...` ..`...a...`...a...`...a...`...a-..`...`...`...a...`Rich...`........PE..d...8............." .................Q...............................................k....`A........................................p.......,...\|.... ...H.......d...........p......P...p...................x...(...`...........................`....................text...s........................... ..`.rdata.............................@..@.data....7...`...(...@..............@....pdata...d.......f...h..............@..@.didat.. ...........................@....rsrc....H... ...J..................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUXPS.DLL

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	4.477100896687311
Encrypted:	false
SSDEEP:	384:TzcEP6TRUpPzapbW8ufOOqvWiMq4GDDKkVuOUSo3OWczkjUJl0azvOpI80Ygkuuc:7pEahYABZI0
MD5:	DFEC0317A1EA262D948A18424B86C2BA
SHA1:	25BC5196E6B47AA72B4F09752382FF2C860FF19B
SHA-256:	9C58C0059F53CD8B796A56A8D3F585A001FD29A3037FE8393292F52DC6AC1944
SHA-512:	522E0FD4788CF0AE5EFE2312C7599D77474E4F54FDB5AC34757091A7ABE13564EE7560E6E83CC6E6417E31BBDF05CFC9A57C0BFFE2B21523F3062A43E9CF957F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V...8...8...8......8...;...8...<...8...9..8...9...8...8...8...0...8.......8...:...8.Rich..8.........PE..d...^............." .........~......0...............................................P.....`A...........................................................................................T............................a...............c..0............................text...p........................... ..`.rdata...c...0...d..................@..@.data................\|..............@....pdata...............~..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUXWiz.exe

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	465920
Entropy (8bit):	6.881687311752545
Encrypted:	false
SSDEEP:	12288:a7lb57GX8YbVe0TIrf8NbywLkRLgLBAgV:ul7Y82VLTIrfMy8oLg
MD5:	02BCE04D6192EB6BC85A195E0187E707
SHA1:	975ECD7E4D51DA13584F8453C9E4959FB94C0545
SHA-256:	6FA424DDD31E80D679D987FD94FB2A35D8BBEAD7F5F09404AF531B46DBAE85B6
SHA-512:	F1B82D484867585E206A2D48B64791724ED9AAE57FE55FAE755A786BEE228482CB9CBC03B1E84CFA4D7FD5BBDA0F733FE9500C8303834E3B23FB89580F589733
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#..bM..bM..bM...N..bM...I..bM...H..bM...L..bM..bL.E`M...E..bM......bM...O..bM.Rich.bM.........PE..d................."..........V.................@.............................`............`.......... .........................................,.... .. ...................P......0f..T.......................(.......................p............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc... ... ...,..................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUX.dll.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77312
Entropy (8bit):	3.9016462651552564
Encrypted:	false
SSDEEP:	768:C12WsiBibFoTwLz7xk+9h67iKlpViTRFjwX42De1OODQ0Oxem2L+UypXkNNsLx7X:A9w0wLz7xk+9hYn1kylOoLKzmHu274e
MD5:	00E741D6381CEF37CE3775365F8905B1
SHA1:	686457F78C8BC1C40E9DDFD5F947CEF6A2BFACB8
SHA-256:	D7677178E9E653C2EE56BB05153F710C089A0FDF4ACD61B227A7848316B3D5BE
SHA-512:	3A22F9F56F616AB5A580F782A1168A16DA0AAF77EA28F2B6A782C4A050D89F2015BFA5616E257EE1A1ECB6B2D840EA90443591CE56EB3FB860D4A71F403D3522
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........,...............................................P.......F....@.......................................... ...(..............................8............................................................................rdata..............................@..@.rsrc....0... ...*..................@..@.....x.&........T...8...8........x.&........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....5.......rsrc$02.... .....fA.%..f....sA.X..1......5..x.&........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUXRes.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78336
Entropy (8bit):	2.8994243966977833
Encrypted:	false
SSDEEP:	768:sW8dlm/JCz244BOtBax2EzNSO1kG9qgiwv3b5KdqpGj0eZk8RVp2I6WNqw4gGu:L8MCf4BOtBax2E8kMB05K0pGloWNqwc
MD5:	2E186A7F6E00285CA1600F6EC0E6EC60
SHA1:	BEACB51296F4D3A1444025627C38ABAF21ED4D4F
SHA-256:	052B316586906985C7C372ECD28B497C3C5ED2A7BF9F08E49AB31003F479E4D8
SHA-512:	08487991457593FE5BB30EDAD55DD672E83284B1C0B76CE54089BFAC3DD2DE00C05491EA49B6EA7A9FD975E6FB4DFC0F2C04A0F6A4DE5AC1973C0CC6FD547CBB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.PE..d.....yO.........." .........0...............................................P............`.......................................................... ..P-..............................8............................................................................rdata..............................@..@.rsrc...P-... ......................@..@......yO........T...8...8.........yO........$...................8....rdata..8...x....rdata$zzzdbg.... ..0....rsrc$01....0$.. )...rsrc$02.... ........8..l4.[...2K.DO_..Z.p..yO........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUXWiz.exe.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	3.305745657724211
Encrypted:	false
SSDEEP:	24:eH1GSAnmQxuWCp24Flaut0WIZW0R5w/aNuf3DA349DAlU35WWdPPYPNy0:yLyojFlaydIZWswUuPDn9D+K5WwHgp
MD5:	C88E574480A4F42BBA617155D3B99729
SHA1:	05C42F31E1FC4B9A09A4019BEE4722B82106F606
SHA-256:	B16969B66A279BB0B771C8CCF0CDD2779797915B5590834B52976B884EA5F68A
SHA-512:	BEEA0027E8DDE536D1285801B5FDFC9F4DF0AD6E5793314D8DB730D72E66A944487C633B3372DAA9E4F68BE7F7CF1DBEAD9899218D57A7B7C71977CECFFF4D8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........................................................0............@.......................................... ..................................8............................................................................rdata..............................@..@.rsrc........ ......................@..@..............T...8...8.................$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01..... .......rsrc$02.... ...J...R.....Y<..z.yB................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\sapi.cpl.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	3.484662654723136
Encrypted:	false
SSDEEP:	192:jnnwPzkyzJTEhzDlpS/aBaUR0DdoNRF8VadaoQSvDDpPndYvWvOWx:jc9TEpxpSC8Q0ZGg8DDpPndYvWvOWx
MD5:	7877D3A5F4D32B379E8209BF9A6C00CE
SHA1:	65A16A418DAA0A98D742A508C3E6D26B33710960
SHA-256:	AA0B020843020224A9AED9D5BD9500668734CEF37BA787CECA0E10B02534C7FA
SHA-512:	0DA65E319D7859B8A614E8B80D227890080F5EF6C10045E1B0DE6FB175D7E96E577EB012BE9156F1DE2EAA9CFE11F0B2B8284DEC167DEE6D6BEFF8DA5A204617
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........J...............................................p............@.......................................... ...G..............................8............................................................................rdata..............................@..@.rsrc....P... ...H..................@..@......).........T...8...8.........).........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....,..(^...rsrc$02.... ....p.9@2.WF.e..%H..f..7.A...D..).........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\speechuxcpl.dll.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.6343445557187257
Encrypted:	false
SSDEEP:	96:W4wsQUC97naKzStnnL6YVU4Hcu/hrCZEWWFcWwUg:W4wP97naKEL6BSckhr/WwcWM
MD5:	91FD2B37FC1D7756B3B6281A64A0E204
SHA1:	F0CB018584E8E7D50AB006DDEFAD49656B279F32
SHA-256:	B90215957B4A69B14694F0DEE7DD236B294B8F2881D11E9CDE13E30BD5128ABA
SHA-512:	06263FD414D727808C5D4960B2530D963B3AA0C9B2C8FDEEFD5DE69C6E3F172D02DF22A2052968018953CBF75470EAEDCC8DAFC668739430D8B822AC99B18ADF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........................................................@......A.....@.......................................... ..D...............................8............................................................................rdata..............................@..@.rsrc.... ... ......................@..@.......X........T...8...8..........X........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....!.......rsrc$02.... ........[.^..b...u...**..Q.$DG....X........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\ru-RU\SpeechUX.dll.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77312
Entropy (8bit):	3.9024324035505042
Encrypted:	false
SSDEEP:	768:j1WWAciBibFoTwLz7xk+9h67iKlpViTRFjwX42De1OODQ0Oxem2L+UypXkNNsLx8:xdl0wLz7xk+9hYn1kylOoLKzmHuJL4e
MD5:	3FB04397AD2245E5FECDD61301E0ABDB
SHA1:	DBDAFFBCE34C5A7B5DDDE260B2DB4E81C225FF0F
SHA-256:	B2AD0F7DC268B4371E41187547B4C8D6BEB990A37B43A1257295FDFAD6D37C18
SHA-512:	523AA4587EA744128EE56D83E06777B3AABAFF18CA352ADB257C964C219B770E5A03F58F6C6DA46AEF62F20DB42F3A0682847E07FDF7E382C2BB0A1D43C67A31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........,...............................................P.......M....@.......................................... ...(..............................8............................................................................rdata..............................@..@.rsrc....0... ...*..................@..@.....x.&........T...8...8........x.&........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....5.......rsrc$02.... .....fA.%..f....sA.X..1......5..x.&........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\ru-RU\SpeechUXWiz.exe.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	3.308058071761624
Encrypted:	false
SSDEEP:	24:eH1GSAW5mQxeWCp24Fu1Laut0WbZW0R5w/aNuf3DA349DAlU35WWdPPYPNyk:yyy4jFKLaydbZWswUuPDn9D+K5WwHg5
MD5:	D246DC71694598FCE6026321BB692133
SHA1:	B8D79EFFD6682DA2DAFE06DC28831F614DD34247
SHA-256:	980CF034A8E6B7AF0224AA945EA37FCDCD2D42A30FF8D37DC60CB38E7C10E275
SHA-512:	D522573112A3227E66573A60E6E2F7C83D6857310F3ECBB0D0A8BB89478ECFC881E9580FF458945FFB564AEA36DB9B78EE5D1FED2DF4D24BAAB8FB9D1A87C399
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........................................................0......6.....@.......................................... ..................................8............................................................................rdata..............................@..@.rsrc........ ......................@..@..............T...8...8.................$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01..... .......rsrc$02.... ...J...R.....Y<..z.yB................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\ru-RU\speechuxcpl.dll.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.144916424063844
Encrypted:	false
SSDEEP:	48:yBtMmAKmq55Y87oLH+P3Jehyi0DRM/L+hg+OSjwGaauNee28bZWxJuT+3Bzdb+ft:sBz5m+PZkyXDIL+jEpek9Wl3BzukU
MD5:	FB407D2CBDC6F7C035AC2D1E72CAC0CA
SHA1:	1352FC6CF552001253DCCEB1CE380FE637496755
SHA-256:	2D0AACB594AC744F32F3701C17B911E845B3D51F583E9903F513C705811BB08F
SHA-512:	2A65E36CCAEA2C266DB5B324832E285832F97C53916AAA7E2C5089B93571DAC57C1FE02698228EE9A926E0524BFB6E0CD43734FAA9A48BD1BAD2888CF94D2A4F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........................................................@......jv....@.......................................... ..$...............................8............................................................................rdata..............................@..@.rsrc.... ... ......................@..@.......X........T...8...8..........X........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....!.......rsrc$02.... ........[.^..b...u...**..Q.$DG....X........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\sapi.cpl

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.676508342306661
Encrypted:	false
SSDEEP:	6144:sU3hZm7vF5qXHgWGQjof9jK57wz/k4KqugbPXU4AgV8:s2hZmj8c4wLkRLgLBAgV
MD5:	2BBBD624B2A736A3806D00280DF1AD3E
SHA1:	CF3D04FD61427BD8DC90327B14DB889A3316FED5
SHA-256:	39BD24863FBB18FF7B14838E8062CAD91286A04550BA405B17E16D82759E23F0
SHA-512:	2D8E2A8EF8195026C87E2FF0351D6BCA7EC32D66197CC9A379974FE1CFCAEB20691FCD23F5F0FBD489A4015858E6D0E6B6B0CE3A871F6EBACBAD6CFAC1DD8B59
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J..+y..+y..+y..@z..+y..@}..+y..+x.S+y..@x..+y..@\|..+y..@y..+y..@q..+y..@...+y..@{..+y.Rich.+y.........PE..d................." ................P...............................................h:....`A........................................`u.......v...........-..........................0W..T............................2...............3...............................text..."........................... ..`.rdata..VX...0...Z..................@..@.data................t..............@....pdata...............v..............@..@.rsrc....-..........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\speechuxcpl.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	456704
Entropy (8bit):	6.279275444299788
Encrypted:	false
SSDEEP:	6144:DHn92Fa74KFycUY6Qwz/k4KqugbPXU4AgV8CCQ4Vb4XURS9Z8DdkTniNnB0OF5O:DH92Fa776QwLkRLgLBAgV7QSjkF5O
MD5:	59149DF9B45EADCBDD38A2352935EB63
SHA1:	7BAAE44743F096616A843BDDD12869641AA969A6
SHA-256:	397550185BCAFA2E46C05DD462C4E8C750E0AC60F896C9EA43493210A9BD7BA2
SHA-512:	FB8488472DA20A5FDE2A82C17D9202603BC893B4A55AAF51C91DD87261D9859C845ADC4435E13AA23B4A73473B008CDD1EE7F1EBDD9EDEDEC118254CB664B796
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c.S.'.=.'.=.'.=.3.>.$.=.3.9.7.=.3.8. .=.'.<.e.=.3.<.0.=.3.=.&.=.3.5.0.=.3..&.=.3.?.&.=.Rich'.=.................PE..d................." ................@........................................@............`A.........................................x.......y...........B...................0.......b..p............................?...............@..@....w..@....................text............................... ..`.rdata...t...0...v..."..............@..@.data...............................@....pdata..............................@..@.didat..(...........................@....rsrc....B.......D..................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97168
Entropy (8bit):	6.424686954579329
Encrypted:	false
SSDEEP:	1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
MD5:	A87575E7CF8967E481241F13940EE4F7
SHA1:	879098B8A353A39E16C79E6479195D43CE98629E
SHA-256:	DED5ADAA94341E6C62AEA03845762591666381DCA30EB7C17261DD154121B83E
SHA-512:	E112F267AE4C9A592D0DD2A19B50187EB13E25F23DED74C2E6CCDE458BCDAEE99F4E3E0A00BAF0E3362167AE7B7FE4F96ECBCD265CC584C1C3A4D1AC316E92F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d...Y.-a.........." .........`......p.....................................................`A.........................................B..4....J...............p..X....X...#..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37240
Entropy (8bit):	6.3017272133584585
Encrypted:	false
SSDEEP:	384:5GnvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbRuncS74G5WreKWn14gHc:rCm5yhUcwrHY/ntTxT6ovq7nt+dN
MD5:	37C372DA4B1ADB96DC995ECB7E68E465
SHA1:	6C1B6CB92FF76C40C77F86EA9A917A5F854397E2
SHA-256:	1554B5802968FDB2705A67CBB61585E9560B9E429D043A5AA742EF3C9BBFB6BF
SHA-512:	926F081B1678C15DC649D7E53BFBE98E4983C9AD6CCDF11C9383CA1D85F2A7353D5C52BEBF867D6E155FF897F4702FC4DA36A8F4CF76B00CB842152935E319A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D_.O.>...>...>...N...>..RK...>...F^..>...>..1>..RK...>..RK...>..RK...>..RK...>..RK2..>..RK...>..Rich.>..........................PE..d...^.-a.........." .....:...6......`A..............................................7]....`A.........................................l.......m..x....................n..x#......<...(b..T............................b..8............P..X............................text...e9.......:.................. ..`.rdata.. "...P...$...>..............@..@.data... ............b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..<............l..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\init.py

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.7776012320135814
Encrypted:	false
SSDEEP:	3:SDXnlvJI1VJ9uoXSPVSfQQDaIFLVd6eOFJi9cr6yn:SzlRFKSPVS9DaIFLVd6p6986yn
MD5:	7F36C3A1229DC69716EEE499EC320A45
SHA1:	56108D0F028BC700971660C860896D38498273D1
SHA-256:	FF1C7CC1A542A71F0C643A90263E4C2A2508C1BF1E444D307720CCF00AEAC0ED
SHA-512:	C8154A7E9FDDD2F56C44FE6195D88E40BF2222AD45371E5AAF8562D7942A2ACC5D4047DADC53799D1DC8C7FEECA79C7A0841421CE703BFCA55D9A38FADB021A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# Pyarmor 8.4.6 (trial), 000000, 2024-05-12T12:07:32.837794..from .pyarmor_runtime import __pyarmor__..

C:\Users\user\AppData\Local\Temp\_MEI50522\pycache\init.cpython-39.pyc

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	python 3.9 byte-compiled
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.722399012935214
Encrypted:	false
SSDEEP:	3:wtLel0VlG1/QlZfQv+21j+66rX2eOX1OxpMBXnUXo37eO+VV/VOMLkcqMX:QO0e1/QC1v6j2pl+MeXwpenJX
MD5:	95A763554322BCAB07C9FEC78B85FA80
SHA1:	C674D621F5B5FCD1E9181C850C6FA7B795649B49
SHA-256:	D1113ABB8FE3AEDB22358C9F4FA06E76858733027A2AFF98ED520C11976B0A70
SHA-512:	36ABC6820114CA4E9F7E2E4714AD50ECC787C3C6B81C1C89FC8E26627642D9A456B34F4C6583D618A13B1AE8676E343E8D03196EAA2F471DEF036B009F6B3DEA
Malicious:	false
Preview:	a.......t.Afg........................@...s....d.d.l.m.Z...d.S.)......)...__pyarmor__N).Z.pyarmor_runtimer......r....r.....JD:\00Th\1 Steal\Droper\Drop8\dist830512\pyarmor_runtime_000000\__init__.py..<module>.........

C:\Users\user\AppData\Local\Temp\_MEI50522\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86984
Entropy (8bit):	6.449825326118893
Encrypted:	false
SSDEEP:	1536:7BVEz7G6jRTRdDsyKzogNC1Ue3FFwOl8lOP1ipVI5tV/7SyIwV:t6znFihztuUe3sOKlg1ipVI5tV/eW
MD5:	7F2BBA8A38712D00907F6E37F0CE6028
SHA1:	E22227FC0FD45AFDCF6C5D31A1CEBFFEE22DFC32
SHA-256:	CD04EBE932B2CB2FD7F01C25412BDDD77B476FA47D0AFF69A04A27D3BFE4B37B
SHA-512:	CA46CEAF1B6683E6D505EDBE33B1D36F2940A72FC34F42FA4AA0928F918D836803113BF9A404657EC3A65BC4E40ED13117AD48457A048C82599DB37F98B68AF0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..>oh.moh.moh.mf.<meh.m=..lmh.m..Rmlh.m=..lch.m=..lgh.m=..lkh.m...llh.m...lmh.moh.m.h.m...lgh.m...lnh.m..Pmnh.m...lnh.mRichoh.m........................PE..d.....;b.........." .........f......0........................................p.......{....`.............................................H............P.......@..4....4.......`...... ...T...............................8...............@............................text...j........................... ..`.rdata...B.......D..................@..@.data........0......................@....pdata..4....@......................@..@.rsrc........P.......(..............@..@.reloc.......`.......2..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	127432
Entropy (8bit):	5.943754325028008
Encrypted:	false
SSDEEP:	3072:ys51kM2JpMk49dWZKrcsaIopJfrZquAAIZI5QP1y:tnkMoOwCcDfrZgAIg
MD5:	38D9D8ED2B7DF64790150A2A523FD3B9
SHA1:	A629C8E76136FA5678C758351E2DCFF5324F51E7
SHA-256:	11DAEF02AFE45D9F3987BAB5C2B6EF75B2B6F6F79704C45675D532F090F14B8B
SHA-512:	7A37A98BB9824680E3F0030E0DB795F9EAB1CC4D2B6605E4F6C37D432B4DE0642481DD7B6C6F0E53264F2D940B4800555AB0D84145D7DE35F4A65A26CA100FE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S..2c..2c..2c..J...2c..Gb..2c..Gf..2c..Gg..2c..G`..2c..Gb..2c.y@g..2c.y@b..2c.0[b..2c..2b.B2c..Gn..2c..Gc..2c..G...2c..Ga..2c.Rich.2c.........PE..d.....;b.........." .................^...............................................6....`..........................................d......te..........................................T........................... ...8............................................text............................... ..`.rdata...p.......r..................@..@.data...D?.......:...v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	272328
Entropy (8bit):	6.531650091351777
Encrypted:	false
SSDEEP:	6144:PSYgOVbBi7eTDJWMccBp0hyQLM1A5h7329qWMa3pLW1AvxzfDbNSQ:1Bi7eTtdbIZLtpUhSQ
MD5:	1139CC9D936B6028305749568EC5CAC7
SHA1:	8AEE810BC2CCFC3C36BEF6ED59B3826BB7070299
SHA-256:	67A47D85CC1A21069610C85DA64FC031231D43AF7876DFC48361C57D88EFEE0B
SHA-512:	1DD4CF64D51A4D9B9F35F1932428F92A3EF538DB62B503097A9DFC1940AFAE59B0D890ACA149A67FF1BD5D343D8E4F38CADD49065404E9CB2902F1ED6DBB754B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.:.`.T.`.T.`.T.i..n.T.2.U.b.T.2.Q.l.T.2.P.h.T.2.W.d.T..U.c.T...U.b.T.`.U...T..W.a.T..Y.o.T..T.a.T....a.T..V.a.T.Rich`.T.........PE..d.....;b.........." .........J......@........................................@......id....`.........................................P...P............ ...........,...........0..`.......T...............................8...............(............................text............................... ..`.rdata..............................@..@.data...X*.......$..................@....pdata...,..........................@..@.rsrc........ ......................@..@.reloc..`....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65480
Entropy (8bit):	6.0825664613687085
Encrypted:	false
SSDEEP:	1536:V2UsyQLwkpuRYqVcXP7O9zozEDvZhjqNI55IE7Syj:V2gSP7QZhjqNI55IE1
MD5:	75ED91D3B7A40ECA5B32A13B90191EAD
SHA1:	320BD4B6116F735D8508382738E50BA8862B8029
SHA-256:	202535A5CEB0BF70C2046639A3884C24F2CCCB1BD92827E61B5A7A663D9399BA
SHA-512:	0EB81335C97842233751E7B4C0D6581ACCAF00A86F3E06FE35B2C80BD6BADF83A321EAF4A449A31238ED3F60AA09890769BF54775CD7EFD5112255842E1582C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x.N...N...N...G..L.......L.......E.......F.......M.......L......L.......M...N..........O.......O.......O.......O...RichN...................PE..d.....;b.........." .....^...........@....................................... ...........`.............................................P......x...............................H...p{..T............................{..8............p..(............................text....].......^.................. ..`.rdata...R...p...T...b..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	163784
Entropy (8bit):	6.779442007393752
Encrypted:	false
SSDEEP:	3072:JaV4kBVeMMbwjQneCHPDLORDEWznfo9mNoPrL4rbVI5e1En:JaV4kBVHMKQZrUDEIwYOPwrb2
MD5:	AD02EA81A127A401F4DF84C082F3CCE6
SHA1:	9C6C851C52F331D17A33936C9AAD8DCEF2542709
SHA-256:	4213FBB6936AD3EAC1E1BA28F10E15719176BC3A59FF01DDC6828DD7EEE52132
SHA-512:	CDCCD9E5FFFC2A2836F7677985D63C0A8A90FC91F1D98A0F2355C11141E21ECD564BBBFBA87E717AC80F784A68B6F43430476FBD72CEC9820C691DF6612FFD16
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N...............u.....X.......X.......X.......X..........................h......0........................Rich............................PE..d.....;b.........." .....\|..........43..............................................*.....`..........................................7..L...\7..x............`.......`..........4...x...T..............................8...............8............................text....z.......\|.................. ..`.rdata..R...........................@..@.data........P.......4..............@....pdata.......`.......<..............@..@.rsrc................T..............@..@.reloc..4............^..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30152
Entropy (8bit):	6.179113434701911
Encrypted:	false
SSDEEP:	384:73ZiJO6iUi3w2SW6A6rOuBvY3nhsXnnSZI57UrIYiSy1pCQLuhmhg:uO6Q3R6rOUQ2iZI57UUYiSyvUmhg
MD5:	F9718FE21174D8428F022AAF60BF92DA
SHA1:	DB7E85EAA7C795792050AF43D47518CA7FA7878A
SHA-256:	95E1C419E08D8AB229B8C64D51FD301CD9D75A659DFC05E75B0317CA0A4F22E3
SHA-512:	000929C994446F22E4F11A011C21B7401BBE8B3B1A624B80A4EEB818F94190B3DB2782B00E477E548814CAEA5234D4DE5A8A766D72365C26654D655EC4546BE3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........q.B...B...B...K..@.......@.......I.......J.......A.......A......@...B...........C.......C.......C.......C...RichB...........PE..d.....;b.........." .........:......................................................bI....`..........................................C..L....C..d....p.......`..0....V..............03..T............................3..8............0..@............................text............................... ..`.rdata.......0......."..............@..@.data... ....P.......@..............@....pdata..0....`.......F..............@..@.rsrc........p.......J..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	80840
Entropy (8bit):	6.16679379591815
Encrypted:	false
SSDEEP:	1536:GBCJoimjxvExWxAm9/s+++pJj1XmrpZxP4cZI5Qw47Syo:dai6lfAm9/sT+pbmrbjZI5Qw46
MD5:	0A6C6FD7697E4C3757014FA6BF6DD615
SHA1:	F14F79831B8B16A7B31F4C7F698317C023D446F9
SHA-256:	A611E9B4F4E5FE67E945B771D79CF15C48441ECFA11CE186CEC9BF233DC20C0D
SHA-512:	F5FCFEDE06F0F81229B946F803B6E292FD0C909191F3C2A82CA317FF7C2E08D1EA98AA2D11EC85EDD5449994A2A7C61318A15D47806CD761E25739494F3E18E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{..............bk......o.......o.......o.......o.......o..............uh.......o.......o.......o.......o......Rich............................PE..d.....;b.........." .....z..........d(.......................................`.......&....`.........................................0...P............@.......0..t............P..........T...........................P...8............................................text....y.......z.................. ..`.rdata..ly.......z...~..............@..@.data...(...........................@....pdata..t....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	156104
Entropy (8bit):	5.936947272634989
Encrypted:	false
SSDEEP:	3072:7+W/EKFRXUxwSYQyDiyqoIpy07KhpGs2W74DH70NmHh4kwooSLteSdN1SGwVI5tB:7GKFRXUxrZyDHKehp9743DthN1SGw0
MD5:	3BAF56D4E63A800FCAF2CC98FC120709
SHA1:	2A33341EDA4B4549452B6DB9B259F8AE6EC9C806
SHA-256:	D7610DD6BE63AADA4FE1895B64BBAC961840257C6988E1F68BBF3D8E486B5A45
SHA-512:	E48899ED5581FE9F45C02219D62E0ACBC92906AF5B7A3B7D9BE1BB28B41F5CFDB0D3496ABC6D0C1A809BB80D2A49C5A456D34E4667995FB88EF8ACA6958881DD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.D. .. .. ..).&..r.+."..r./.,..r...(..r.).#....+."....+.$.. .+.X....+.'....'.".....!.....!....(.!..Rich ..........................PE..d.....;b.........." .........................................................p............`.........................................@...d............P.......@.......B.......`..........T...............................8............................................text............................... ..`.rdata..............................@..@.data... n.......h..................@....pdata.......@....... ..............@..@.rsrc........P.......*..............@..@.reloc.......`.......4..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24520
Entropy (8bit):	6.177351750137684
Encrypted:	false
SSDEEP:	384:oTcuByPxXyessB5XnkPrVI5ewOIYiSy1pCQvVFh6:owCiB50PrVI5ewDYiSyvnh6
MD5:	EFAAB22452B7D55BD684F29D7DF015A0
SHA1:	ED9A244F5CCE66B69FA275704BA8048C3956DB91
SHA-256:	D8B97BD2D8D372B5B7675F5EC8A31A7F7D01AB36DD8C8273273B4C465B70C4E5
SHA-512:	AF7E6535C8E0C540E0BE69A164C00FBF03C572FAEA871A377DB72937A8A54E015EA278FE8981D9A27DAF9BFC094AEEFD036E5B143C58B776AFE995D4B503790A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4F.bU(.bU(.bU(.k-..`U(.0 ).`U(.0 -.iU(.0 ,.jU(.0 +.aU(.. ).`U(..').gU(.bU).KU(.. .cU(.. (.cU(.. ..cU(.. .cU(.RichbU(.........................PE..d.....;b.........." ...............t.....................................................`..........................................9..L...<:..x....p.......`..\|....@..........<...L2..T............................2..8............0..p............................text............................... ..`.rdata.......0......................@..@.data........P......................@....pdata..\|....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..<............>..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\base_library.zip

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1038695
Entropy (8bit):	5.492286183311183
Encrypted:	false
SSDEEP:	24576:TK73vupwcosQNRs54PK4ItEVwHkfVExmFgBTUSCM:TK73vuecosQNRs54PK4ID+wTx
MD5:	2E134828C303EDBF09DD29AD27DD4B8A
SHA1:	F6D87842CB0273BCB5C62F457CE15F17F4AE1772
SHA-256:	53322BCD7DB062B523F28DD68DBA06BBECB20421018F98E199B65D837B3517CE
SHA-512:	C3115B060578ACC3AE414E94A60A4082FB069577B2D39BD897D463CB515BBAA033E0E21B1BCA3ED218A78C42D869A69352EA2E588CADE11AC26BE5444A3997B0
Malicious:	false
Preview:	PK..........!...=............_bootlocale.pyca....................................@....x...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nHz.e.j...W.n2..e.yh......e.e.d...rZd.d.d...Z.n.d.d.d...Z.Y.n.0.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...\|.r.J...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).Nr......darwin..r....

C:\Users\user\AppData\Local\Temp\_MEI50522\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290282
Entropy (8bit):	6.048183244201235
Encrypted:	false
SSDEEP:	6144:QW1H/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5Np:QWN/TRJLWURrI55MWavdF0L
MD5:	302B49C5F476C0AE35571430BB2E4AA0
SHA1:	35A7837A3F1B960807BF46B1C95EC22792262846
SHA-256:	CF9D37FA81407AFE11DCC0D70FE602561422AA2344708C324E4504DB8C6C5748
SHA-512:	1345AF52984B570B1FF223032575FEB36CDFB4F38E75E0BD3B998BC46E9C646F7AC5C583D23A70460219299B9C04875EF672BF5A0D614618731DF9B7A5637D0A
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI50522\charset_normalizer\md.cp39-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.673140392808471
Encrypted:	false
SSDEEP:	96:sh72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh2XQMtCFrHx0gzcX6g8cim1qeSju1:u2HzzU2bRYoexHXzcqgvimoe
MD5:	D93AD224C10BA644F92232A7B7575E23
SHA1:	4A9ABC6292E7434D4B5DD38D18C9C1028564C722
SHA-256:	89268BE3CF07B1E3354DDB617CB4FE8D4A37B9A1B474B001DB70165BA75CFF23
SHA-512:	B7D86ECD5A7372B92EB6C769047B97E9AF0F875B2B02CFF3E95D3E154EF03D6B9CF39CC3810C5ECA9FEA38FEA6201E26F520DA8B9255A35E40D6EC3D73BB4929
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b6..&W..&W..&W..//..$W..3(..$W..m/..$W..3(..-W..3(...W..3(..%W.."..%W..&W...W.....'W.....'W....a.'W.....'W..Rich&W..........................PE..d...?hAe.........." ...%.....................................................p............`..........................................'..l...\(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\charset_normalizer\md__mypyc.cp39-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	5.877090503831313
Encrypted:	false
SSDEEP:	3072:mYKj20ufpEMocaJX3kjtOvBRPLugqZGL5GF:ONdDKZGLW
MD5:	B5692F504B608BE714D5149D35C8C92A
SHA1:	62521C88D619ACFFF0F5680F3A9B4C043ACF9A1D
SHA-256:	969196CD7CADE4FE63D17CF103B29F14E85246715B1F7558D86E18410DB7BBC0
SHA-512:	364EB2157B821C38BDEED5A0922F595FD4EEAD18CEAB84C8B48F42EA49AE301AABC482D25F064495B458CDCB8BFAB5F8001D29A306A6CE1BBB65DB41047D8EA5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..S.xr..xr..xr......xr...s..xr.Q.s..xr...w..xr...v..xr...q..xr...s..xr..xs..xr.#.z..xr.#.r..xr.#....xr.#.p..xr.Rich.xr.........PE..d...>hAe.........." ...%.............2....................................... ............`.............................................`...........................................Px...............................w..@............@...............................text...8-.......................... ..`.rdata...X...@...Z...2..............@..@.data...8=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\icon.ico

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	67646
Entropy (8bit):	2.9877924081466984
Encrypted:	false
SSDEEP:	768:76/22LIO5zUSFZGcj3TQip80U7YVhCUsmlqnrL8sRVzbEQwnOUwFxF9qgdTddRj+:eLVEB1e
MD5:	B0FE457D80C766030BE3804E149F4A95
SHA1:	32530E3AB0BBD5B22B0FC544FFE829709CAE02EC
SHA-256:	1472F258F96FFDBB6B0E147260943599ABACDF6DF0DACE38ABAC9744D6B18590
SHA-512:	EB704A2CB38F594B80EAEC2D1FDB9D5F9BB6FB04494799895CF12CB002205225983D5B217B19C61672BE43F9EFAD752F1726B0D62EB7A75777F3A893AD6BEC0A
Malicious:	false
Preview:	............ .(.......(............. .........8...8...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................82&.94&.93&.82&.82&.82&.82&.82&.82&.82&.82&.82&.82&.82&.82&.82&.82&.51%.51%.92&...................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3439512
Entropy (8bit):	6.096012359425593
Encrypted:	false
SSDEEP:	98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
MD5:	AB01C808BED8164133E5279595437D3D
SHA1:	0F512756A8DB22576EC2E20CF0CAFEC7786FB12B
SHA-256:	9C0A0A11629CCED6A064932E95A0158EE936739D75A56338702FED97CB0BAD55
SHA-512:	4043CDA02F6950ABDC47413CFD8A0BA5C462F16BCD4F339F9F5A690823F4D0916478CAB5CAE81A3D5B03A8A196E17A716B06AFEE3F92DEC3102E3BBC674774F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........R.m.R.m.R.m.[...@.m.0.l.P.m.0.h.^.m.0.i.Z.m.0.n.V.m.R.l..m..l.Y.m...n.O.m...i.+.m...m.S.m....S.m...o.S.m.RichR.m.........................PE..d...`.0b.........." ......$...................................................5......4...`..........................................x/..h...:4.@....p4.\|....p2.8....\4.......4..O....,.8...........................`.,.@............04..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......p2.......1.............@..@.idata..^#...04..$....3.............@..@.00cfg..u....`4.......3.............@..@.rsrc...\|....p4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	698784
Entropy (8bit):	5.533720236597082
Encrypted:	false
SSDEEP:	12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
MD5:	DE72697933D7673279FB85FD48D1A4DD
SHA1:	085FD4C6FB6D89FFCC9B2741947B74F0766FC383
SHA-256:	ED1C8769F5096AFD000FC730A37B11177FCF90890345071AB7FBCEAC684D571F
SHA-512:	0FD4678C65DA181D7C27B19056D5AB0E5DD0E9714E9606E524CDAD9E46EC4D0B35FE22D594282309F718B30E065F6896674D3EDCE6B3B0C8EB637A3680715C2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.T.?.:.?.:.?.:.6f..3.:.]f;.=.:..l;.=.:.]f?.3.:.]f>.7.:.]f9.;.:..g;.<.:.?.;...:..g>...:..g:.>.:..g.>.:..g8.>.:.Rich?.:.........PE..d.....0b.........." .....<...T......<................................................[....`.........................................00...N..HE..........s.......\|M..............h... ...8...............................@............0..H............................text....:.......<.................. ..`.rdata..:....P...0...@..............@..@.data...AM.......D...p..............@....pdata..dV.......X..................@..@.idata..PW...0...X..................@..@.00cfg..u............d..............@..@.rsrc...s............f..............@..@.reloc..a............n..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\packs.sha256

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	490927
Entropy (8bit):	5.03059381086955
Encrypted:	false
SSDEEP:	6144:kPM4sAhq8NRToFMC5B3YC6WWmO5NUjEeinQHBWW2d9KEaFvdBhhPh25dmNC+F:kPM4FC5FBWna5ik2dAFv/hueNC+F
MD5:	F957DAA947E41003AFF3BE5285EF16A9
SHA1:	0AF8277470EBB644C9110689E34676924A6B632E
SHA-256:	BE9032D65E872891DB9722CB4ED28CCC2F176C84DD1455D0B313E3957B44B849
SHA-512:	BEC4AA85F89F74C4BFF8F82C73890243635A4E6F6BE29063FF4E41F3035C97636B99E6F91CCF711F0B48A21555C4ED84400CBEE84152AA245BEF7C6396F11EC6
Malicious:	false
Preview:	8f3f95e347f711c7c92f1a692d6ce1915627447defc49b587ebf6a5073efb9e7 en-US/aadcloudap.dll.mui.c20bd71ff07f98477f1fc7c1990c80aed0e60c3768b7f229acfa7286293a29d6 en-US/aadtb.dll.mui.06cee7c3dd9f4fe48a7a1050a7be3f8dc294625d5511a8cd9ab51374451c6503 en-US/aadWamExtension.dll.mui.d82af48cb0e3a76c01dabaa6506ad9a130fb0a38dc5cc8d9fa5c0f239c7ef672 en-US/AboutSettingsHandlers.dll.mui.47a07b5fc2b4a56090e4ec0e5dcd37d788f8f91371ae6766c58ae34dcc42b86e en-US/accessibilitycpl.dll.mui.cc52234329ba0f35f2b5f81bcc8b35d6dbe2f87bc41a8c310b7c7d53d5d71aa3 en-US/AccountAccessor.dll.mui.413f96a418cb3cbcd97fd9dd8a645547cb94a1d2d3dffe72a3770f1e4dc99ec8 en-US/AccountsRT.dll.mui.4ce1031f1547a268103f60fe57aeb61efe45743369254878c28969a603d4218e en-US/acledit.dll.mui.066f09f0acb78ee34f295c353f74b597108d0866bf48eed03bd29162031070c0 en-US/aclui.dll.mui.0aca2a811c1936c4201c86743a717dc1ef715ec37d06236a743d2e7818f65737 en-US/acppage.dll.mui.1a786782e1f158a8981f27b06044181c79581051f2e0f20a673218490c2d8def en-US/acproxy

C:\Users\user\AppData\Local\Temp\_MEI50522\pyarmor_runtime.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	620032
Entropy (8bit):	6.1916778134841906
Encrypted:	false
SSDEEP:	12288:qTlIttemLwKXcuFdcj7fUoPHlttNynEGyEC:q5w/cuFdcj7fUoPHlttNynH
MD5:	149DBFEB76B9F8F6B7DDDE1EAAC61118
SHA1:	747DB9BF10E9231DEB2CB2619C5ECF89B7DB6232
SHA-256:	1CEBFDD7C65B99DC6EE477BFAD9F236940EAA8C0383A90A68EE467D32411C01F
SHA-512:	92BF3BF0A7E41CB06958E4AC23665E324A3220BFD49C2FAA366C9DD37E39F95770559F75285B38E3F15B0C8D5829D8BBBD7EA4ACD9F31A2CCBB53A428DA34FB4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........r...h..0..........a.............................P.......o........ .........................................]........2..............p#...........@..................................(.......................`............................text...h...........................`.P`.data....H.......J..................@.`..rdata.......@......................@.`@.pdata..p#.......$..................@.0@.xdata...%...0...&..................@.0@.bss.....f...`........................`..edata..]............8..............@.0@.idata...2.......4...:..............@.0..CRT....X.... .......n..............@.@..tls.........0.......p..............@.@..reloc.......@.......r..............@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\pyarmor_runtime_000000\pyarmor_runtime.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	620032
Entropy (8bit):	6.1916778134841906
Encrypted:	false
SSDEEP:	12288:qTlIttemLwKXcuFdcj7fUoPHlttNynEGyEC:q5w/cuFdcj7fUoPHlttNynH
MD5:	149DBFEB76B9F8F6B7DDDE1EAAC61118
SHA1:	747DB9BF10E9231DEB2CB2619C5ECF89B7DB6232
SHA-256:	1CEBFDD7C65B99DC6EE477BFAD9F236940EAA8C0383A90A68EE467D32411C01F
SHA-512:	92BF3BF0A7E41CB06958E4AC23665E324A3220BFD49C2FAA366C9DD37E39F95770559F75285B38E3F15B0C8D5829D8BBBD7EA4ACD9F31A2CCBB53A428DA34FB4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........r...h..0..........a.............................P.......o........ .........................................]........2..............p#...........@..................................(.......................`............................text...h...........................`.P`.data....H.......J..................@.`..rdata.......@......................@.`@.pdata..p#.......$..................@.0@.xdata...%...0...&..................@.0@.bss.....f...`........................`..edata..]............8..............@.0@.idata...2.......4...:..............@.0..CRT....X.... .......n..............@.@..tls.........0.......p..............@.@..reloc.......@.......r..............@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\python39.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4523976
Entropy (8bit):	6.435919894293302
Encrypted:	false
SSDEEP:	98304:Grk4ZPyKFv2bwgdGGtudvURuHRMXIwzXT:GrjZKKFehdGGt5XlXT
MD5:	19E6D310C1BD0578D468A888D3EC0E3D
SHA1:	32561AD9B89DC9E9A086569780890AD10337E698
SHA-256:	F4609EC3BBCC74ED9257E3440EC15ADF3061F7162A89E4E9A370E1C2273370A1
SHA-512:	4A8332C22A40A170EA83FC8CFD5B8A0ED0DF1D59FD22EBE10088BA0BE78CC0E91A537D7085549A4D06204CBE77E83154A812DAED885C25AA4B4CB4ACA5B9CC85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F....\|...\|...\|..P....\|..d....\|..P....\|..P....\|..P....\|....h..\|.......\|...\|..Y}.......\|.......\|.......\|.......\|..Rich.\|..........PE..d...l.;b.........." ......#...#.....0.........................................G.....":E...`..........................................I=.......>.\|....0G.......D..8....D......@G..v...Y%.T...........................@Z%.8.............#.h............................text...$.#.......#................. ..`.rdata...S....#..T....#.............@..@.data........@>.......>.............@....pdata...8....D..:...,B.............@..@.rsrc........0G......fD.............@..@.reloc...v...@G..x...pD.............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\pywin32_system32\pywintypes39.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	6.0017332542566715
Encrypted:	false
SSDEEP:	3072://ZCM+lst/TPZa4TjDY/r06trJhQAjkYe1K6SXxKpjAjfMG://ZCplst/TPnY/rxt6A4Ye1KbXYpEjf
MD5:	F20FD2E2AC9058A9FD227172F8FF2C12
SHA1:	89EBA891352BE46581B94A17DB7C2EDE9A39AB01
SHA-256:	20BDE8E50E42F7AABF59106EEA238FCC0DECE0C6E362C0A7FEEB004AB981DB8A
SHA-512:	42A86FA192AEA7ADB4283DC48A323A4F687DAD40060EA3FFDDCD8FD7670BB535D31A7764706E5C5473DA28399FEC048AE714A111EE238BB25E1AAD03E12078D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.$.X.w.X.w.X.w. Kw.X.w.-.v.X.w.7%w.X.w.-.v.X.w.-.v.X.w.-.v.X.w.3.v.X.wY1.v.X.w.3.v.X.w.X.w&X.w.-.v.X.w.-.v.X.w.-.v.X.wRich.X.w........PE..d......d.........." .........................................................P............`..........................................u..`B..p...,....0..d.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..\...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...d....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\select.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29640
Entropy (8bit):	6.24629892386138
Encrypted:	false
SSDEEP:	768:g2YyAU1265whJBHqgORWZI57GZYiSyvwhT:v86Gh/KgORWZI57GZ7Syo
MD5:	196C4D2F8BDC9E9D2DBCCE866050684C
SHA1:	1166C85C761D8188C45D9CC7441ABFE8A7071132
SHA-256:	CD31F9F557D57A6909186940EAFE483C37DE9A7251E604644A747C7EC26B7823
SHA-512:	CB9A02530721482F0FF912CA65DAE94F6930676E2390CB5523F99452174622D7E2E70CAFAF46E053F0C3DFC314EDC8C2F4FD3BC7EA888BE81E83FF40D3A30E78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... ...N...N...N.......N...O...N...K...N...J...N...M...N.O.O...N...O...N.!.O...N.O.C...N.O.N...N.O.....N.O.L...N.Rich..N.........................PE..d.....;b.........." ....."...4......................................................3<....`..........................................Q..L....R..x............p..T....T..........D....B..T...........................0C..8............@..(............................text.... .......".................. ..`.rdata..J....@.......&..............@..@.data........`.......B..............@....pdata..T....p.......D..............@..@.rsrc................H..............@..@.reloc..D............R..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1122248
Entropy (8bit):	5.37506480885596
Encrypted:	false
SSDEEP:	12288:CezMmuZ63NhQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uoUT:CezuiZV0m88MMREtV6Vo4uYoUT
MD5:	684AE6992F55AD6C64588367E42F44F7
SHA1:	66D8868286924ADA60966A620DFFE87B2C978711
SHA-256:	91834E28CC0ACBD966DC6D323B95113E0050301B7CD6CD4ABE43390F2BBDDB34
SHA-512:	70453EE98CBF6365AA7A326520CDAD438D6A1D6F463DA6180CB5E20708647951831D232B577BE50A16825912A9E40386C64A9987E3265FC870CDDD918B31614C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".$~fOJ-fOJ-fOJ-o7.-`OJ-4:K,dOJ-4:O,jOJ-4:N,nOJ-4:I,eOJ-.:K,eOJ-.=K,dOJ-fOK-,OJ-.:G,gOJ-.:J,gOJ-.:.-gOJ-.:H,gOJ-RichfOJ-........PE..d.....;b.........." .....J..........T).......................................@............`.............................................X...h........ .......................0......`L..T............................L..8............`...............................text....I.......J.................. ..`.rdata.."....`.......N..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	5.851469350935171
Encrypted:	false
SSDEEP:	3072:pI+kHubb2wCc8Rd0BvDAQolRVFhLaNKPNyymA4FZ5dorG0e:ShObbac8Rd0BUlRVlPNynFZ57
MD5:	05E4B3B876E5FA6A2B8951F764559623
SHA1:	4AD50F70EEF4FEAA9D051C2F161FBAC8A862A4BC
SHA-256:	A52F8BD28B5B9558CDE10333CE452A7D6F338CE1005A2B8451755005868E4A98
SHA-512:	5648306AF7C056C9250731B7D5A508664294BBB8BA865F9DC06FD7216ADF7B8CC31B1CFBC0175C7F2752680744F6546A1959E7F7D1EC7A8A845F75642CE034D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.uV0...0...0...9...8...b...4...b...8...b...4.......2.......2...b...'...$...;...0...g.......2.......1.......1...Rich0...................PE..d......d.........." .........................................................P............`..........................................................0..T....................@..$....v..T............................<..8............0..........@....................text............................... ..`.rdata......0......................@..@.data...x(......."..................@....pdata..............................@..@.rsrc...T....0......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI50522\win32event.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	5.566183037243278
Encrypted:	false
SSDEEP:	768:pu2z3oHKLNA/jhfWddbcrsdcBi60k/MwJba:pXkHkNA/jhfWddbcBBi60k/MwJba
MD5:	E4C515DF1FEDF6BC59E7FED6AB194E00
SHA1:	B26384AEC2EE25EE59CD45FB77AC04A3FB46A80F
SHA-256:	E469C3E9A6836CE38DEA05854D27CAA33EB766882527F73F60E3E2254BADC51B
SHA-512:	123D16456B86C406F23C366349DF5785D9CC793ADBBBB7CF50B64B318C16F5FE703B600A3C67A979319BC779049F786F4AD675C22B1973FA712C6623695E7EF7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.*..uD..uD..uD......uD.F.E..uD.F.A..uD.F.@..uD.F.G..uD...E..uD..E..uD...E..uD..uE.NuD...M..uD...D..uD...F..uD.Rich.uD.........................PE..d......d.........." .....8...4.......3....................................................`..........................................f..T...4g..........\............................Z..T............................Z..8............P...............................text...86.......8.................. ..`.rdata...#...P...$...<..............@..@.data................`..............@....pdata...............d..............@..@.rsrc...\............j..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Common\en-US\sapi.dll.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	3.560212102277829
Encrypted:	false
SSDEEP:	192:4LEUt5t468Uq0voq3qv/DX0k8QtrutqGW9uJq/6kqHt8NZrzW0NWL:qd8r026yruBW9VUt0ZrzW0NWL
MD5:	4D5B570C6A43917B52741B707341FDDA
SHA1:	010A9C83255E9271154280418BF601F975430DD9
SHA-256:	809AB1C72338B01C0DE9D7367E2763FCA896E0F6EC7E833F45DE45C3BC033134
SHA-512:	4A7767152DBF40F41F0CB7399E3040DA4AE4D33D2204468EC0DDC0CA9B60F3424E7DD489463AB227584DA31DB550537140E980B271B8D2F434265B3627971729
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........>...............................................`............@.......................................... ..D;..............................8............................................................................rdata..............................@..@.rsrc....@... ...<..................@..@.....>.........T...8...8........>.........$...................8....rdata..8...x....rdata$zzzdbg.... ..0....rsrc$01....0#..08...rsrc$02.... ...r..P....i....<.? =.Y.....W..>.........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Common\sapi.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1569792
Entropy (8bit):	6.1201506655739
Encrypted:	false
SSDEEP:	24576:7l085rs7VUKi682+npiLP82fIyL0/PcioZ:7qwsk1KLP82fI
MD5:	F977B1ED7C926A23C9993E0CD9822B8E
SHA1:	A90AB8D7D7F4C54829700700B210B17D63BA1F4D
SHA-256:	958A63EFC1D059A3F8699B6A2AE1D59A1898F948A7819CC886A946F1C0E6496F
SHA-512:	AEB28D8A69C7734F25DFF71B2715512122573EE05014A543054C8F79B8FD78E132BC1184069D7534F3073B121ADD245BDAC2AE7900E0637E1B8D3536E586F3C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Xh@.6;@.6;@.6;T.7:U.6;@.7;..6;T.5:K.6;T.2:.6;T.3:q.6;T.6:A.6;T.>:>.6;T..;A.6;T.4:A.6;Rich@.6;........PE..d................" .........................................................`.......~....`A.........................................:......$;.......p....................... ..l3......p.......................(................... ........8.......................text............................... ..`.rdata.. L.......N..................@..@.data...(X...`...4...J..............@....pdata...............~..............@..@.didat..p....`......................@....rsrc........p......................@..@.reloc..l3... ...4..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\en-US\srloc.dll.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.5855334678640385
Encrypted:	false
SSDEEP:	48:y+3B1xI/cY2gFQK44asIFOFYQaEVKZWPTHzawuGZ/AK5WwZHV:DUcYj2UOWPTuZUHWwb
MD5:	311C1AE96CA16A1F9C0F4857AB81BD2F
SHA1:	2FC721FD5E5CEDE54C6B598D0F473D61EB31F830
SHA-256:	F57D453C82D5CEEB269E28961241C5F027EC17F65E6D1E8A45229471DBB5476F
SHA-512:	EDB5961D57FD5C77CB57E1CDDE945BDF9C3A4753B96EDBAD6F890337BA9D32E29B80F94850593B3F08BAC4B5C1BCAF2B9FF8C4A891204C4720AE4A939EF39825
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........................................................0.......-....@.......................................... ..l...............................8............................................................................rdata..............................@..@.rsrc........ ......................@..@......)\........T...8...8.........)\........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....!.......rsrc$02.... ..._...Y ..9.h.._lG.\@.....@.c..)\........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\spsreng.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1073152
Entropy (8bit):	6.650667849531351
Encrypted:	false
SSDEEP:	24576:fAGx/PfINLsVkWOur35TgkvUnHNyop+1BwBBH:fBPgBHur356z
MD5:	FC3F513DBFA7AE54EF4E3498D9E9784B
SHA1:	3F29B2C3E1E34D3062B17525669CD3B6F82961A2
SHA-256:	67DF7281CE98F247F25427232785A8D651472E21488BF2CB4AB57CBAAB7BE016
SHA-512:	D9594815B4A71BA70E16AA26317D7C8D93171EF958F824FA99AB9F8EE15885940D44D47334A6CF4668BDD27C10B3044DB131D841ACAD631869E9D3853775F2CC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.b..y...y...y.......y...y...y.......y.......y......Oy.......y.......y......y.......y..Rich.y..........PE..d...4............." .....N...2......0b..............................................E.....`A................................................T...x................o.................. <..p...................x...(...`...................H............................text...,M.......N.................. ..`.rdata..\....`.......R..............@..@.data...............................@....pdata...o.......p..................@..@.rsrc................L..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\spsrx.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	105472
Entropy (8bit):	5.961405979583004
Encrypted:	false
SSDEEP:	3072:HGvgUUbeZWCkPhh7rnrwwFQIgplqiOPRcuwtB9N6f:mvgD7rnVQIgpl16otB9
MD5:	F3A75622E931E20DFFD1DAA951D71F39
SHA1:	B94BB09EB306B88972397B8AF555623F0655F086
SHA-256:	7B8F98BE4BD2145E4E1E4C71C6D2A1B789C6810F0582209502F4666A035B41C1
SHA-512:	6222714A9F2F37CB58577EDE6D8246C528488D878830313D3D84372F1DCE8C5B79CEF99C4AC5CF229F2366663F1BB1DC7B8855DCD234426CFA202E32A08E8330
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4..@4..@4..@ ..A?..@4..@A..@ ..A=..@ ..Az..@ ..A...@ ..A5..@ ..A;..@ .*@5..@ ..A5..@Rich4..@................PE..d...Kc+..........." .................p..............................................^.....`A........................................@&.......&..x........`...p..................T...`...p...........................0...............H................................text............................... ..`.rdata...P.......R..................@..@.data....#...@......................@....pdata.......p.......,..............@..@.rsrc....`.......b...6..............@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\SR\srloc.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	486400
Entropy (8bit):	6.223693489277457
Encrypted:	false
SSDEEP:	12288:eQnZiz8HurXkIvbEoQwHG7jeCYtpEo7Tf:eQn/urXzzEtNopH7T
MD5:	29BB9B5D6EFA4A639759E59641AA5821
SHA1:	DC6E55DDB6F5C5061F48238E4AEC290E26EC7804
SHA-256:	F373673D34CC74F76F8C951B664589845B9DD82C939F6973C67E8FFF7D6F9840
SHA-512:	5E9D38856FA39F7F9221BCA2C9FDB72E62590D9544E9446CD76AD983FD4454885E52DACCFE8E1A71F1CBEAAC1BA23E981B051FB89819532698AF0AA20E15D65E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........c.M..[M..[M..[D.[O..[Y..ZF..[M..[..[Y..ZA..[Y..Z..[Y..Z...[Y..ZL..[Y..Z/..[Y..[L..[Y..ZL..[RichM..[........PE..d...j............." .................,...............................................o....`A................................................t...........8....`..P...............x......p...................x7..(...`6...............7..`............................text............................... ..`.rdata..............................@..@.data...._.......>..................@....pdata..P....`...0..."..............@..@.rsrc...8............R..............@..@.reloc..x............X..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\TTS\MSTTSEngine.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1011072
Entropy (8bit):	6.305825051822925
Encrypted:	false
SSDEEP:	24576:60Ys17BeFoRnCANrxjmao8OC7VM5s4sJQ10c1pSCLiXt3juk1vcMmLglSuCJ:ldF8FCCyrxjmatrV0sQ0cKmQBTM1
MD5:	F9512C058964F125C0C0883C0CCA225E
SHA1:	F5BE9E7DECF8A6BFAD3411FF8AE15E8F40405215
SHA-256:	41CE9B38D03E80088A744C13229CAB4BC4CC9FBCF60C0E553A8E66EA8F9B07A4
SHA-512:	1CE62154B0DBB0C4C55F7BD87C97877FEBD2CE59F8FACFB2C10D38F7F0968D3350B279A6D6853E71097093728120415DFDCE54D169819A789CA65A6A453A639D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Iu.....T...T...T.lBT...T...U...T...U...T...T...T...U...T...U...T...U...T...U%..T...T...T...U...TRich...T........................PE..d......n.........." ......................................................................`A................................................x...........8w.......g...H...%...p..@.......p...........................0)..............H*...............................text............................... ..`.rdata...`.......b..................@..@.data...@V... ...N..................@....pdata...g.......h...L..............@..@.rsrc...8w.......x..................@..@.reloc..@....p.......,..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\Engines\TTS\MSTTSLoc.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	521728
Entropy (8bit):	5.26816086887833
Encrypted:	false
SSDEEP:	6144:ZhyW3FrJhNl7y10hwkxJ7HNfS3GtsLtQNnzs4G8thhqsNYcoCfgISw:KW3F1Xl7ykxxt94b2hhqKYcngIS
MD5:	40EB1F198A18021833E65A076955B03C
SHA1:	730F666A44942AD4BA59C69948036C57B5DB9827
SHA-256:	4ED0E11DF812CD586423182568E2F28B3DBA92F85B5FDA68351BF97468083079
SHA-512:	70C9514587B81EE9A744234F5A5AFA1FBADB1DF4E457D7A47B304736240B60320B330A655F7A9F907247A049C134B3B488AF9898ACE8263026F83C745006DD35
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Xc.s... ... ... .z. ... .i.!... .i.!... ... ... .i.!... .i.!... .i.!... .i.!... .ii ... .i.!... Rich... ........................PE..d...D..".........." .........N...............................................0............`A............................................P.......................L)..............@>...k..p...........................P...............h................................text... ........................... ..`.rdata...2.......4..................@..@.data...............................@....pdata..L).......*..................@..@.rsrc...............................@..@.reloc..@>.......@..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SPTIP.DLL

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159232
Entropy (8bit):	6.141294435501823
Encrypted:	false
SSDEEP:	3072:wFp5C2mYK1JVOaFXlEbfIfhvIAG7+lyXOzt+ikzN:kp5CasO+1EjIfhvI/eyXy52N
MD5:	C4D73A4379E6F55F698532ECBC9579BE
SHA1:	FB53B40E6BEC2AEBB0BA97D86FE1D3C7CCE94D94
SHA-256:	683F604AD40AB82382809D75595F734B672FAC75E1E8EF63C94683D11C848D6D
SHA-512:	1AF8F089F4CCB67ADAB896AB7C0B23D69D3BEEB493E719FBEF55B507295CCDA7E7343D59504102433D02EA800C7FDEDFECE4252C36514537C52BD35FC067E8E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[\~..=...=...=...V...=...V...=...=...=...V...=...V...=...V...=...V...=...V..=...V...=..Rich.=..........PE..d... <............" ................0...............................................k.....`A................................................D........@...C...0..........................p...............................................p............................text............................... ..`.rdata..JN.......P..................@..@.data...x.... ......................@....pdata.......0......................@..@.rsrc....C...@...D...&..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SpeechUX.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1453568
Entropy (8bit):	6.7106066470226216
Encrypted:	false
SSDEEP:	24576:lwcdUsNWUncNv/WwMri3RtZDJK3e86Lq2i1Sj57nyTTHmdR9adKn0ox8oLg:lrOsNtme5yPAe8GVjlnwy0dM0QLg
MD5:	6BFEF5D4BA0C93C0BCE2593BAC58015C
SHA1:	B03839587DC0CAD96277E0621850D6B151CF90A6
SHA-256:	A7E2602CE3D1093712D316497D887D0C97A9738EDC026726055BF07572D84099
SHA-512:	EDECCB0697F8CD7EAAF6E96AF783B328278AA53C02CF08A64403C3D04738CD0DC0746B726ECD010023F17B07DCDD1EA8B6BB47F7C122BC413D5A977AF20B2810
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s3...`...`...`...a...`...a...`...` ..`...a...`...a...`...a...`...a-..`...`...`...a...`Rich...`........PE..d...8............." .................Q...............................................k....`A........................................p.......,...\|.... ...H.......d...........p......P...p...................x...(...`...........................`....................text...s........................... ..`.rdata.............................@..@.data....7...`...(...@..............@....pdata...d.......f...h..............@..@.didat.. ...........................@....rsrc....H... ...J..................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SpeechUXPS.DLL

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	4.477100896687311
Encrypted:	false
SSDEEP:	384:TzcEP6TRUpPzapbW8ufOOqvWiMq4GDDKkVuOUSo3OWczkjUJl0azvOpI80Ygkuuc:7pEahYABZI0
MD5:	DFEC0317A1EA262D948A18424B86C2BA
SHA1:	25BC5196E6B47AA72B4F09752382FF2C860FF19B
SHA-256:	9C58C0059F53CD8B796A56A8D3F585A001FD29A3037FE8393292F52DC6AC1944
SHA-512:	522E0FD4788CF0AE5EFE2312C7599D77474E4F54FDB5AC34757091A7ABE13564EE7560E6E83CC6E6417E31BBDF05CFC9A57C0BFFE2B21523F3062A43E9CF957F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V...8...8...8......8...;...8...<...8...9..8...9...8...8...8...0...8.......8...:...8.Rich..8.........PE..d...^............." .........~......0...............................................P.....`A...........................................................................................T............................a...............c..0............................text...p........................... ..`.rdata...c...0...d..................@..@.data................\|..............@....pdata...............~..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\SpeechUXWiz.exe

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	465920
Entropy (8bit):	6.881687311752545
Encrypted:	false
SSDEEP:	12288:a7lb57GX8YbVe0TIrf8NbywLkRLgLBAgV:ul7Y82VLTIrfMy8oLg
MD5:	02BCE04D6192EB6BC85A195E0187E707
SHA1:	975ECD7E4D51DA13584F8453C9E4959FB94C0545
SHA-256:	6FA424DDD31E80D679D987FD94FB2A35D8BBEAD7F5F09404AF531B46DBAE85B6
SHA-512:	F1B82D484867585E206A2D48B64791724ED9AAE57FE55FAE755A786BEE228482CB9CBC03B1E84CFA4D7FD5BBDA0F733FE9500C8303834E3B23FB89580F589733
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#..bM..bM..bM...N..bM...I..bM...H..bM...L..bM..bL.E`M...E..bM......bM...O..bM.Rich.bM.........PE..d................."..........V.................@.............................`............`.......... .........................................,.... .. ...................P......0f..T.......................(.......................p............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc... ... ...,..................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\SpeechUX.dll.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77312
Entropy (8bit):	3.9016462651552564
Encrypted:	false
SSDEEP:	768:C12WsiBibFoTwLz7xk+9h67iKlpViTRFjwX42De1OODQ0Oxem2L+UypXkNNsLx7X:A9w0wLz7xk+9hYn1kylOoLKzmHu274e
MD5:	00E741D6381CEF37CE3775365F8905B1
SHA1:	686457F78C8BC1C40E9DDFD5F947CEF6A2BFACB8
SHA-256:	D7677178E9E653C2EE56BB05153F710C089A0FDF4ACD61B227A7848316B3D5BE
SHA-512:	3A22F9F56F616AB5A580F782A1168A16DA0AAF77EA28F2B6A782C4A050D89F2015BFA5616E257EE1A1ECB6B2D840EA90443591CE56EB3FB860D4A71F403D3522
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........,...............................................P.......F....@.......................................... ...(..............................8............................................................................rdata..............................@..@.rsrc....0... ...*..................@..@.....x.&........T...8...8........x.&........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....5.......rsrc$02.... .....fA.%..f....sA.X..1......5..x.&........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\SpeechUXRes.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78336
Entropy (8bit):	2.8994243966977833
Encrypted:	false
SSDEEP:	768:sW8dlm/JCz244BOtBax2EzNSO1kG9qgiwv3b5KdqpGj0eZk8RVp2I6WNqw4gGu:L8MCf4BOtBax2E8kMB05K0pGloWNqwc
MD5:	2E186A7F6E00285CA1600F6EC0E6EC60
SHA1:	BEACB51296F4D3A1444025627C38ABAF21ED4D4F
SHA-256:	052B316586906985C7C372ECD28B497C3C5ED2A7BF9F08E49AB31003F479E4D8
SHA-512:	08487991457593FE5BB30EDAD55DD672E83284B1C0B76CE54089BFAC3DD2DE00C05491EA49B6EA7A9FD975E6FB4DFC0F2C04A0F6A4DE5AC1973C0CC6FD547CBB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.PE..d.....yO.........." .........0...............................................P............`.......................................................... ..P-..............................8............................................................................rdata..............................@..@.rsrc...P-... ......................@..@......yO........T...8...8.........yO........$...................8....rdata..8...x....rdata$zzzdbg.... ..0....rsrc$01....0$.. )...rsrc$02.... ........8..l4.[...2K.DO_..Z.p..yO........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\SpeechUXWiz.exe.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	3.305745657724211
Encrypted:	false
SSDEEP:	24:eH1GSAnmQxuWCp24Flaut0WIZW0R5w/aNuf3DA349DAlU35WWdPPYPNy0:yLyojFlaydIZWswUuPDn9D+K5WwHgp
MD5:	C88E574480A4F42BBA617155D3B99729
SHA1:	05C42F31E1FC4B9A09A4019BEE4722B82106F606
SHA-256:	B16969B66A279BB0B771C8CCF0CDD2779797915B5590834B52976B884EA5F68A
SHA-512:	BEEA0027E8DDE536D1285801B5FDFC9F4DF0AD6E5793314D8DB730D72E66A944487C633B3372DAA9E4F68BE7F7CF1DBEAD9899218D57A7B7C71977CECFFF4D8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........................................................0............@.......................................... ..................................8............................................................................rdata..............................@..@.rsrc........ ......................@..@..............T...8...8.................$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01..... .......rsrc$02.... ...J...R.....Y<..z.yB................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\sapi.cpl.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	3.484662654723136
Encrypted:	false
SSDEEP:	192:jnnwPzkyzJTEhzDlpS/aBaUR0DdoNRF8VadaoQSvDDpPndYvWvOWx:jc9TEpxpSC8Q0ZGg8DDpPndYvWvOWx
MD5:	7877D3A5F4D32B379E8209BF9A6C00CE
SHA1:	65A16A418DAA0A98D742A508C3E6D26B33710960
SHA-256:	AA0B020843020224A9AED9D5BD9500668734CEF37BA787CECA0E10B02534C7FA
SHA-512:	0DA65E319D7859B8A614E8B80D227890080F5EF6C10045E1B0DE6FB175D7E96E577EB012BE9156F1DE2EAA9CFE11F0B2B8284DEC167DEE6D6BEFF8DA5A204617
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........J...............................................p............@.......................................... ...G..............................8............................................................................rdata..............................@..@.rsrc....P... ...H..................@..@......).........T...8...8.........).........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....,..(^...rsrc$02.... ....p.9@2.WF.e..%H..f..7.A...D..).........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\en-US\speechuxcpl.dll.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.6343445557187257
Encrypted:	false
SSDEEP:	96:W4wsQUC97naKzStnnL6YVU4Hcu/hrCZEWWFcWwUg:W4wP97naKEL6BSckhr/WwcWM
MD5:	91FD2B37FC1D7756B3B6281A64A0E204
SHA1:	F0CB018584E8E7D50AB006DDEFAD49656B279F32
SHA-256:	B90215957B4A69B14694F0DEE7DD236B294B8F2881D11E9CDE13E30BD5128ABA
SHA-512:	06263FD414D727808C5D4960B2530D963B3AA0C9B2C8FDEEFD5DE69C6E3F172D02DF22A2052968018953CBF75470EAEDCC8DAFC668739430D8B822AC99B18ADF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........................................................@......A.....@.......................................... ..D...............................8............................................................................rdata..............................@..@.rsrc.... ... ......................@..@.......X........T...8...8..........X........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....!.......rsrc$02.... ........[.^..b...u...**..Q.$DG....X........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\ru-RU\SpeechUX.dll.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77312
Entropy (8bit):	3.9024324035505042
Encrypted:	false
SSDEEP:	768:j1WWAciBibFoTwLz7xk+9h67iKlpViTRFjwX42De1OODQ0Oxem2L+UypXkNNsLx8:xdl0wLz7xk+9hYn1kylOoLKzmHuJL4e
MD5:	3FB04397AD2245E5FECDD61301E0ABDB
SHA1:	DBDAFFBCE34C5A7B5DDDE260B2DB4E81C225FF0F
SHA-256:	B2AD0F7DC268B4371E41187547B4C8D6BEB990A37B43A1257295FDFAD6D37C18
SHA-512:	523AA4587EA744128EE56D83E06777B3AABAFF18CA352ADB257C964C219B770E5A03F58F6C6DA46AEF62F20DB42F3A0682847E07FDF7E382C2BB0A1D43C67A31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........,...............................................P.......M....@.......................................... ...(..............................8............................................................................rdata..............................@..@.rsrc....0... ...*..................@..@.....x.&........T...8...8........x.&........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....5.......rsrc$02.... .....fA.%..f....sA.X..1......5..x.&........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\ru-RU\SpeechUXWiz.exe.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	3.308058071761624
Encrypted:	false
SSDEEP:	24:eH1GSAW5mQxeWCp24Fu1Laut0WbZW0R5w/aNuf3DA349DAlU35WWdPPYPNyk:yyy4jFKLaydbZWswUuPDn9D+K5WwHg5
MD5:	D246DC71694598FCE6026321BB692133
SHA1:	B8D79EFFD6682DA2DAFE06DC28831F614DD34247
SHA-256:	980CF034A8E6B7AF0224AA945EA37FCDCD2D42A30FF8D37DC60CB38E7C10E275
SHA-512:	D522573112A3227E66573A60E6E2F7C83D6857310F3ECBB0D0A8BB89478ECFC881E9580FF458945FFB564AEA36DB9B78EE5D1FED2DF4D24BAAB8FB9D1A87C399
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........................................................0......6.....@.......................................... ..................................8............................................................................rdata..............................@..@.rsrc........ ......................@..@..............T...8...8.................$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01..... .......rsrc$02.... ...J...R.....Y<..z.yB................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\ru-RU\speechuxcpl.dll.mui

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.144916424063844
Encrypted:	false
SSDEEP:	48:yBtMmAKmq55Y87oLH+P3Jehyi0DRM/L+hg+OSjwGaauNee28bZWxJuT+3Bzdb+ft:sBz5m+PZkyXDIL+jEpek9Wl3BzukU
MD5:	FB407D2CBDC6F7C035AC2D1E72CAC0CA
SHA1:	1352FC6CF552001253DCCEB1CE380FE637496755
SHA-256:	2D0AACB594AC744F32F3701C17B911E845B3D51F583E9903F513C705811BB08F
SHA-512:	2A65E36CCAEA2C266DB5B324832E285832F97C53916AAA7E2C5089B93571DAC57C1FE02698228EE9A926E0524BFB6E0CD43734FAA9A48BD1BAD2888CF94D2A4F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5.<.q.R.q.R.q.R.e...p.R.e.P.p.R.Richq.R.................PE..L..................!.........................................................@......jv....@.......................................... ..$...............................8............................................................................rdata..............................@..@.rsrc.... ... ......................@..@.......X........T...8...8..........X........$...................8....rdata..8...x....rdata$zzzdbg.... .......rsrc$01.....!.......rsrc$02.... ........[.^..b...u...**..Q.$DG....X........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\sapi.cpl

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.676508342306661
Encrypted:	false
SSDEEP:	6144:sU3hZm7vF5qXHgWGQjof9jK57wz/k4KqugbPXU4AgV8:s2hZmj8c4wLkRLgLBAgV
MD5:	2BBBD624B2A736A3806D00280DF1AD3E
SHA1:	CF3D04FD61427BD8DC90327B14DB889A3316FED5
SHA-256:	39BD24863FBB18FF7B14838E8062CAD91286A04550BA405B17E16D82759E23F0
SHA-512:	2D8E2A8EF8195026C87E2FF0351D6BCA7EC32D66197CC9A379974FE1CFCAEB20691FCD23F5F0FBD489A4015858E6D0E6B6B0CE3A871F6EBACBAD6CFAC1DD8B59
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J..+y..+y..+y..@z..+y..@}..+y..+x.S+y..@x..+y..@\|..+y..@y..+y..@q..+y..@...+y..@{..+y.Rich.+y.........PE..d................." ................P...............................................h:....`A........................................`u.......v...........-..........................0W..T............................2...............3...............................text..."........................... ..`.rdata..VX...0...Z..................@..@.data................t..............@....pdata...............v..............@..@.rsrc....-..........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\Speech\SpeechUX\speechuxcpl.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	456704
Entropy (8bit):	6.279275444299788
Encrypted:	false
SSDEEP:	6144:DHn92Fa74KFycUY6Qwz/k4KqugbPXU4AgV8CCQ4Vb4XURS9Z8DdkTniNnB0OF5O:DH92Fa776QwLkRLgLBAgV7QSjkF5O
MD5:	59149DF9B45EADCBDD38A2352935EB63
SHA1:	7BAAE44743F096616A843BDDD12869641AA969A6
SHA-256:	397550185BCAFA2E46C05DD462C4E8C750E0AC60F896C9EA43493210A9BD7BA2
SHA-512:	FB8488472DA20A5FDE2A82C17D9202603BC893B4A55AAF51C91DD87261D9859C845ADC4435E13AA23B4A73473B008CDD1EE7F1EBDD9EDEDEC118254CB664B796
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c.S.'.=.'.=.'.=.3.>.$.=.3.9.7.=.3.8. .=.'.<.e.=.3.<.0.=.3.=.&.=.3.5.0.=.3..&.=.3.?.&.=.Rich'.=.................PE..d................." ................@........................................@............`A.........................................x.......y...........B...................0.......b..p............................?...............@..@....w..@....................text............................... ..`.rdata...t...0...v..."..............@..@.data...............................@....pdata..............................@..@.didat..(...........................@....rsrc....B.......D..................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97168
Entropy (8bit):	6.424686954579329
Encrypted:	false
SSDEEP:	1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
MD5:	A87575E7CF8967E481241F13940EE4F7
SHA1:	879098B8A353A39E16C79E6479195D43CE98629E
SHA-256:	DED5ADAA94341E6C62AEA03845762591666381DCA30EB7C17261DD154121B83E
SHA-512:	E112F267AE4C9A592D0DD2A19B50187EB13E25F23DED74C2E6CCDE458BCDAEE99F4E3E0A00BAF0E3362167AE7B7FE4F96ECBCD265CC584C1C3A4D1AC316E92F0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d...Y.-a.........." .........`......p.....................................................`A.........................................B..4....J...............p..X....X...#..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37240
Entropy (8bit):	6.3017272133584585
Encrypted:	false
SSDEEP:	384:5GnvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbRuncS74G5WreKWn14gHc:rCm5yhUcwrHY/ntTxT6ovq7nt+dN
MD5:	37C372DA4B1ADB96DC995ECB7E68E465
SHA1:	6C1B6CB92FF76C40C77F86EA9A917A5F854397E2
SHA-256:	1554B5802968FDB2705A67CBB61585E9560B9E429D043A5AA742EF3C9BBFB6BF
SHA-512:	926F081B1678C15DC649D7E53BFBE98E4983C9AD6CCDF11C9383CA1D85F2A7353D5C52BEBF867D6E155FF897F4702FC4DA36A8F4CF76B00CB842152935E319A6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D_.O.>...>...>...N...>..RK...>...F^..>...>..1>..RK...>..RK...>..RK...>..RK...>..RK2..>..RK...>..Rich.>..........................PE..d...^.-a.........." .....:...6......`A..............................................7]....`A.........................................l.......m..x....................n..x#......<...(b..T............................b..8............P..X............................text...e9.......:.................. ..`.rdata.. "...P...$...>..............@..@.data... ............b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..<............l..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\init.py

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.7776012320135814
Encrypted:	false
SSDEEP:	3:SDXnlvJI1VJ9uoXSPVSfQQDaIFLVd6eOFJi9cr6yn:SzlRFKSPVS9DaIFLVd6p6986yn
MD5:	7F36C3A1229DC69716EEE499EC320A45
SHA1:	56108D0F028BC700971660C860896D38498273D1
SHA-256:	FF1C7CC1A542A71F0C643A90263E4C2A2508C1BF1E444D307720CCF00AEAC0ED
SHA-512:	C8154A7E9FDDD2F56C44FE6195D88E40BF2222AD45371E5AAF8562D7942A2ACC5D4047DADC53799D1DC8C7FEECA79C7A0841421CE703BFCA55D9A38FADB021A0
Malicious:	false
Preview:	# Pyarmor 8.4.6 (trial), 000000, 2024-05-12T12:07:32.837794..from .pyarmor_runtime import __pyarmor__..

C:\Users\user\AppData\Local\Temp\_MEI68642\pycache\init.cpython-39.pyc

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	python 3.9 byte-compiled
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.722399012935214
Encrypted:	false
SSDEEP:	3:wtLel0VlG1/QlZfQv+21j+66rX2eOX1OxpMBXnUXo37eO+VV/VOMLkcqMX:QO0e1/QC1v6j2pl+MeXwpenJX
MD5:	95A763554322BCAB07C9FEC78B85FA80
SHA1:	C674D621F5B5FCD1E9181C850C6FA7B795649B49
SHA-256:	D1113ABB8FE3AEDB22358C9F4FA06E76858733027A2AFF98ED520C11976B0A70
SHA-512:	36ABC6820114CA4E9F7E2E4714AD50ECC787C3C6B81C1C89FC8E26627642D9A456B34F4C6583D618A13B1AE8676E343E8D03196EAA2F471DEF036B009F6B3DEA
Malicious:	false
Preview:	a.......t.Afg........................@...s....d.d.l.m.Z...d.S.)......)...__pyarmor__N).Z.pyarmor_runtimer......r....r.....JD:\00Th\1 Steal\Droper\Drop8\dist830512\pyarmor_runtime_000000\__init__.py..<module>.........

C:\Users\user\AppData\Local\Temp\_MEI68642\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86984
Entropy (8bit):	6.449825326118893
Encrypted:	false
SSDEEP:	1536:7BVEz7G6jRTRdDsyKzogNC1Ue3FFwOl8lOP1ipVI5tV/7SyIwV:t6znFihztuUe3sOKlg1ipVI5tV/eW
MD5:	7F2BBA8A38712D00907F6E37F0CE6028
SHA1:	E22227FC0FD45AFDCF6C5D31A1CEBFFEE22DFC32
SHA-256:	CD04EBE932B2CB2FD7F01C25412BDDD77B476FA47D0AFF69A04A27D3BFE4B37B
SHA-512:	CA46CEAF1B6683E6D505EDBE33B1D36F2940A72FC34F42FA4AA0928F918D836803113BF9A404657EC3A65BC4E40ED13117AD48457A048C82599DB37F98B68AF0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..>oh.moh.moh.mf.<meh.m=..lmh.m..Rmlh.m=..lch.m=..lgh.m=..lkh.m...llh.m...lmh.moh.m.h.m...lgh.m...lnh.m..Pmnh.m...lnh.mRichoh.m........................PE..d.....;b.........." .........f......0........................................p.......{....`.............................................H............P.......@..4....4.......`...... ...T...............................8...............@............................text...j........................... ..`.rdata...B.......D..................@..@.data........0......................@....pdata..4....@......................@..@.rsrc........P.......(..............@..@.reloc.......`.......2..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	127432
Entropy (8bit):	5.943754325028008
Encrypted:	false
SSDEEP:	3072:ys51kM2JpMk49dWZKrcsaIopJfrZquAAIZI5QP1y:tnkMoOwCcDfrZgAIg
MD5:	38D9D8ED2B7DF64790150A2A523FD3B9
SHA1:	A629C8E76136FA5678C758351E2DCFF5324F51E7
SHA-256:	11DAEF02AFE45D9F3987BAB5C2B6EF75B2B6F6F79704C45675D532F090F14B8B
SHA-512:	7A37A98BB9824680E3F0030E0DB795F9EAB1CC4D2B6605E4F6C37D432B4DE0642481DD7B6C6F0E53264F2D940B4800555AB0D84145D7DE35F4A65A26CA100FE8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S..2c..2c..2c..J...2c..Gb..2c..Gf..2c..Gg..2c..G`..2c..Gb..2c.y@g..2c.y@b..2c.0[b..2c..2b.B2c..Gn..2c..Gc..2c..G...2c..Ga..2c.Rich.2c.........PE..d.....;b.........." .................^...............................................6....`..........................................d......te..........................................T........................... ...8............................................text............................... ..`.rdata...p.......r..................@..@.data...D?.......:...v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	272328
Entropy (8bit):	6.531650091351777
Encrypted:	false
SSDEEP:	6144:PSYgOVbBi7eTDJWMccBp0hyQLM1A5h7329qWMa3pLW1AvxzfDbNSQ:1Bi7eTtdbIZLtpUhSQ
MD5:	1139CC9D936B6028305749568EC5CAC7
SHA1:	8AEE810BC2CCFC3C36BEF6ED59B3826BB7070299
SHA-256:	67A47D85CC1A21069610C85DA64FC031231D43AF7876DFC48361C57D88EFEE0B
SHA-512:	1DD4CF64D51A4D9B9F35F1932428F92A3EF538DB62B503097A9DFC1940AFAE59B0D890ACA149A67FF1BD5D343D8E4F38CADD49065404E9CB2902F1ED6DBB754B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.:.`.T.`.T.`.T.i..n.T.2.U.b.T.2.Q.l.T.2.P.h.T.2.W.d.T..U.c.T...U.b.T.`.U...T..W.a.T..Y.o.T..T.a.T....a.T..V.a.T.Rich`.T.........PE..d.....;b.........." .........J......@........................................@......id....`.........................................P...P............ ...........,...........0..`.......T...............................8...............(............................text............................... ..`.rdata..............................@..@.data...X*.......$..................@....pdata...,..........................@..@.rsrc........ ......................@..@.reloc..`....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65480
Entropy (8bit):	6.0825664613687085
Encrypted:	false
SSDEEP:	1536:V2UsyQLwkpuRYqVcXP7O9zozEDvZhjqNI55IE7Syj:V2gSP7QZhjqNI55IE1
MD5:	75ED91D3B7A40ECA5B32A13B90191EAD
SHA1:	320BD4B6116F735D8508382738E50BA8862B8029
SHA-256:	202535A5CEB0BF70C2046639A3884C24F2CCCB1BD92827E61B5A7A663D9399BA
SHA-512:	0EB81335C97842233751E7B4C0D6581ACCAF00A86F3E06FE35B2C80BD6BADF83A321EAF4A449A31238ED3F60AA09890769BF54775CD7EFD5112255842E1582C2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x.N...N...N...G..L.......L.......E.......F.......M.......L......L.......M...N..........O.......O.......O.......O...RichN...................PE..d.....;b.........." .....^...........@....................................... ...........`.............................................P......x...............................H...p{..T............................{..8............p..(............................text....].......^.................. ..`.rdata...R...p...T...b..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	163784
Entropy (8bit):	6.779442007393752
Encrypted:	false
SSDEEP:	3072:JaV4kBVeMMbwjQneCHPDLORDEWznfo9mNoPrL4rbVI5e1En:JaV4kBVHMKQZrUDEIwYOPwrb2
MD5:	AD02EA81A127A401F4DF84C082F3CCE6
SHA1:	9C6C851C52F331D17A33936C9AAD8DCEF2542709
SHA-256:	4213FBB6936AD3EAC1E1BA28F10E15719176BC3A59FF01DDC6828DD7EEE52132
SHA-512:	CDCCD9E5FFFC2A2836F7677985D63C0A8A90FC91F1D98A0F2355C11141E21ECD564BBBFBA87E717AC80F784A68B6F43430476FBD72CEC9820C691DF6612FFD16
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N...............u.....X.......X.......X.......X..........................h......0........................Rich............................PE..d.....;b.........." .....\|..........43..............................................*.....`..........................................7..L...\7..x............`.......`..........4...x...T..............................8...............8............................text....z.......\|.................. ..`.rdata..R...........................@..@.data........P.......4..............@....pdata.......`.......<..............@..@.rsrc................T..............@..@.reloc..4............^..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30152
Entropy (8bit):	6.179113434701911
Encrypted:	false
SSDEEP:	384:73ZiJO6iUi3w2SW6A6rOuBvY3nhsXnnSZI57UrIYiSy1pCQLuhmhg:uO6Q3R6rOUQ2iZI57UUYiSyvUmhg
MD5:	F9718FE21174D8428F022AAF60BF92DA
SHA1:	DB7E85EAA7C795792050AF43D47518CA7FA7878A
SHA-256:	95E1C419E08D8AB229B8C64D51FD301CD9D75A659DFC05E75B0317CA0A4F22E3
SHA-512:	000929C994446F22E4F11A011C21B7401BBE8B3B1A624B80A4EEB818F94190B3DB2782B00E477E548814CAEA5234D4DE5A8A766D72365C26654D655EC4546BE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........q.B...B...B...K..@.......@.......I.......J.......A.......A......@...B...........C.......C.......C.......C...RichB...........PE..d.....;b.........." .........:......................................................bI....`..........................................C..L....C..d....p.......`..0....V..............03..T............................3..8............0..@............................text............................... ..`.rdata.......0......."..............@..@.data... ....P.......@..............@....pdata..0....`.......F..............@..@.rsrc........p.......J..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	80840
Entropy (8bit):	6.16679379591815
Encrypted:	false
SSDEEP:	1536:GBCJoimjxvExWxAm9/s+++pJj1XmrpZxP4cZI5Qw47Syo:dai6lfAm9/sT+pbmrbjZI5Qw46
MD5:	0A6C6FD7697E4C3757014FA6BF6DD615
SHA1:	F14F79831B8B16A7B31F4C7F698317C023D446F9
SHA-256:	A611E9B4F4E5FE67E945B771D79CF15C48441ECFA11CE186CEC9BF233DC20C0D
SHA-512:	F5FCFEDE06F0F81229B946F803B6E292FD0C909191F3C2A82CA317FF7C2E08D1EA98AA2D11EC85EDD5449994A2A7C61318A15D47806CD761E25739494F3E18E6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{..............bk......o.......o.......o.......o.......o..............uh.......o.......o.......o.......o......Rich............................PE..d.....;b.........." .....z..........d(.......................................`.......&....`.........................................0...P............@.......0..t............P..........T...........................P...8............................................text....y.......z.................. ..`.rdata..ly.......z...~..............@..@.data...(...........................@....pdata..t....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	156104
Entropy (8bit):	5.936947272634989
Encrypted:	false
SSDEEP:	3072:7+W/EKFRXUxwSYQyDiyqoIpy07KhpGs2W74DH70NmHh4kwooSLteSdN1SGwVI5tB:7GKFRXUxrZyDHKehp9743DthN1SGw0
MD5:	3BAF56D4E63A800FCAF2CC98FC120709
SHA1:	2A33341EDA4B4549452B6DB9B259F8AE6EC9C806
SHA-256:	D7610DD6BE63AADA4FE1895B64BBAC961840257C6988E1F68BBF3D8E486B5A45
SHA-512:	E48899ED5581FE9F45C02219D62E0ACBC92906AF5B7A3B7D9BE1BB28B41F5CFDB0D3496ABC6D0C1A809BB80D2A49C5A456D34E4667995FB88EF8ACA6958881DD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.D. .. .. ..).&..r.+."..r./.,..r...(..r.).#....+."....+.$.. .+.X....+.'....'.".....!.....!....(.!..Rich ..........................PE..d.....;b.........." .........................................................p............`.........................................@...d............P.......@.......B.......`..........T...............................8............................................text............................... ..`.rdata..............................@..@.data... n.......h..................@....pdata.......@....... ..............@..@.rsrc........P.......*..............@..@.reloc.......`.......4..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24520
Entropy (8bit):	6.177351750137684
Encrypted:	false
SSDEEP:	384:oTcuByPxXyessB5XnkPrVI5ewOIYiSy1pCQvVFh6:owCiB50PrVI5ewDYiSyvnh6
MD5:	EFAAB22452B7D55BD684F29D7DF015A0
SHA1:	ED9A244F5CCE66B69FA275704BA8048C3956DB91
SHA-256:	D8B97BD2D8D372B5B7675F5EC8A31A7F7D01AB36DD8C8273273B4C465B70C4E5
SHA-512:	AF7E6535C8E0C540E0BE69A164C00FBF03C572FAEA871A377DB72937A8A54E015EA278FE8981D9A27DAF9BFC094AEEFD036E5B143C58B776AFE995D4B503790A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4F.bU(.bU(.bU(.k-..`U(.0 ).`U(.0 -.iU(.0 ,.jU(.0 +.aU(.. ).`U(..').gU(.bU).KU(.. .cU(.. (.cU(.. ..cU(.. .cU(.RichbU(.........................PE..d.....;b.........." ...............t.....................................................`..........................................9..L...<:..x....p.......`..\|....@..........<...L2..T............................2..8............0..p............................text............................... ..`.rdata.......0......................@..@.data........P......................@....pdata..\|....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..<............>..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\base_library.zip

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1038695
Entropy (8bit):	5.492286183311183
Encrypted:	false
SSDEEP:	24576:TK73vupwcosQNRs54PK4ItEVwHkfVExmFgBTUSCM:TK73vuecosQNRs54PK4ID+wTx
MD5:	2E134828C303EDBF09DD29AD27DD4B8A
SHA1:	F6D87842CB0273BCB5C62F457CE15F17F4AE1772
SHA-256:	53322BCD7DB062B523F28DD68DBA06BBECB20421018F98E199B65D837B3517CE
SHA-512:	C3115B060578ACC3AE414E94A60A4082FB069577B2D39BD897D463CB515BBAA033E0E21B1BCA3ED218A78C42D869A69352EA2E588CADE11AC26BE5444A3997B0
Malicious:	false
Preview:	PK..........!...=............_bootlocale.pyca....................................@....x...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nHz.e.j...W.n2..e.yh......e.e.d...rZd.d.d...Z.n.d.d.d...Z.Y.n.0.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...\|.r.J...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).Nr......darwin..r....

C:\Users\user\AppData\Local\Temp\_MEI68642\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290282
Entropy (8bit):	6.048183244201235
Encrypted:	false
SSDEEP:	6144:QW1H/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5Np:QWN/TRJLWURrI55MWavdF0L
MD5:	302B49C5F476C0AE35571430BB2E4AA0
SHA1:	35A7837A3F1B960807BF46B1C95EC22792262846
SHA-256:	CF9D37FA81407AFE11DCC0D70FE602561422AA2344708C324E4504DB8C6C5748
SHA-512:	1345AF52984B570B1FF223032575FEB36CDFB4F38E75E0BD3B998BC46E9C646F7AC5C583D23A70460219299B9C04875EF672BF5A0D614618731DF9B7A5637D0A
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer\md.cp39-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.673140392808471
Encrypted:	false
SSDEEP:	96:sh72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh2XQMtCFrHx0gzcX6g8cim1qeSju1:u2HzzU2bRYoexHXzcqgvimoe
MD5:	D93AD224C10BA644F92232A7B7575E23
SHA1:	4A9ABC6292E7434D4B5DD38D18C9C1028564C722
SHA-256:	89268BE3CF07B1E3354DDB617CB4FE8D4A37B9A1B474B001DB70165BA75CFF23
SHA-512:	B7D86ECD5A7372B92EB6C769047B97E9AF0F875B2B02CFF3E95D3E154EF03D6B9CF39CC3810C5ECA9FEA38FEA6201E26F520DA8B9255A35E40D6EC3D73BB4929
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b6..&W..&W..&W..//..$W..3(..$W..m/..$W..3(..-W..3(...W..3(..%W.."..%W..&W...W.....'W.....'W....a.'W.....'W..Rich&W..........................PE..d...?hAe.........." ...%.....................................................p............`..........................................'..l...\(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\charset_normalizer\md__mypyc.cp39-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	5.877090503831313
Encrypted:	false
SSDEEP:	3072:mYKj20ufpEMocaJX3kjtOvBRPLugqZGL5GF:ONdDKZGLW
MD5:	B5692F504B608BE714D5149D35C8C92A
SHA1:	62521C88D619ACFFF0F5680F3A9B4C043ACF9A1D
SHA-256:	969196CD7CADE4FE63D17CF103B29F14E85246715B1F7558D86E18410DB7BBC0
SHA-512:	364EB2157B821C38BDEED5A0922F595FD4EEAD18CEAB84C8B48F42EA49AE301AABC482D25F064495B458CDCB8BFAB5F8001D29A306A6CE1BBB65DB41047D8EA5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..S.xr..xr..xr......xr...s..xr.Q.s..xr...w..xr...v..xr...q..xr...s..xr..xs..xr.#.z..xr.#.r..xr.#....xr.#.p..xr.Rich.xr.........PE..d...>hAe.........." ...%.............2....................................... ............`.............................................`...........................................Px...............................w..@............@...............................text...8-.......................... ..`.rdata...X...@...Z...2..............@..@.data...8=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\icon.ico

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	67646
Entropy (8bit):	2.9877924081466984
Encrypted:	false
SSDEEP:	768:76/22LIO5zUSFZGcj3TQip80U7YVhCUsmlqnrL8sRVzbEQwnOUwFxF9qgdTddRj+:eLVEB1e
MD5:	B0FE457D80C766030BE3804E149F4A95
SHA1:	32530E3AB0BBD5B22B0FC544FFE829709CAE02EC
SHA-256:	1472F258F96FFDBB6B0E147260943599ABACDF6DF0DACE38ABAC9744D6B18590
SHA-512:	EB704A2CB38F594B80EAEC2D1FDB9D5F9BB6FB04494799895CF12CB002205225983D5B217B19C61672BE43F9EFAD752F1726B0D62EB7A75777F3A893AD6BEC0A
Malicious:	false
Preview:	............ .(.......(............. .........8...8...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................82&.94&.93&.82&.82&.82&.82&.82&.82&.82&.82&.82&.82&.82&.82&.82&.82&.51%.51%.92&...................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3439512
Entropy (8bit):	6.096012359425593
Encrypted:	false
SSDEEP:	98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
MD5:	AB01C808BED8164133E5279595437D3D
SHA1:	0F512756A8DB22576EC2E20CF0CAFEC7786FB12B
SHA-256:	9C0A0A11629CCED6A064932E95A0158EE936739D75A56338702FED97CB0BAD55
SHA-512:	4043CDA02F6950ABDC47413CFD8A0BA5C462F16BCD4F339F9F5A690823F4D0916478CAB5CAE81A3D5B03A8A196E17A716B06AFEE3F92DEC3102E3BBC674774F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........R.m.R.m.R.m.[...@.m.0.l.P.m.0.h.^.m.0.i.Z.m.0.n.V.m.R.l..m..l.Y.m...n.O.m...i.+.m...m.S.m....S.m...o.S.m.RichR.m.........................PE..d...`.0b.........." ......$...................................................5......4...`..........................................x/..h...:4.@....p4.\|....p2.8....\4.......4..O....,.8...........................`.,.@............04..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......p2.......1.............@..@.idata..^#...04..$....3.............@..@.00cfg..u....`4.......3.............@..@.rsrc...\|....p4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	698784
Entropy (8bit):	5.533720236597082
Encrypted:	false
SSDEEP:	12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
MD5:	DE72697933D7673279FB85FD48D1A4DD
SHA1:	085FD4C6FB6D89FFCC9B2741947B74F0766FC383
SHA-256:	ED1C8769F5096AFD000FC730A37B11177FCF90890345071AB7FBCEAC684D571F
SHA-512:	0FD4678C65DA181D7C27B19056D5AB0E5DD0E9714E9606E524CDAD9E46EC4D0B35FE22D594282309F718B30E065F6896674D3EDCE6B3B0C8EB637A3680715C2C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.T.?.:.?.:.?.:.6f..3.:.]f;.=.:..l;.=.:.]f?.3.:.]f>.7.:.]f9.;.:..g;.<.:.?.;...:..g>...:..g:.>.:..g.>.:..g8.>.:.Rich?.:.........PE..d.....0b.........." .....<...T......<................................................[....`.........................................00...N..HE..........s.......\|M..............h... ...8...............................@............0..H............................text....:.......<.................. ..`.rdata..:....P...0...@..............@..@.data...AM.......D...p..............@....pdata..dV.......X..................@..@.idata..PW...0...X..................@..@.00cfg..u............d..............@..@.rsrc...s............f..............@..@.reloc..a............n..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\packs.sha256

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	490927
Entropy (8bit):	5.03059381086955
Encrypted:	false
SSDEEP:	6144:kPM4sAhq8NRToFMC5B3YC6WWmO5NUjEeinQHBWW2d9KEaFvdBhhPh25dmNC+F:kPM4FC5FBWna5ik2dAFv/hueNC+F
MD5:	F957DAA947E41003AFF3BE5285EF16A9
SHA1:	0AF8277470EBB644C9110689E34676924A6B632E
SHA-256:	BE9032D65E872891DB9722CB4ED28CCC2F176C84DD1455D0B313E3957B44B849
SHA-512:	BEC4AA85F89F74C4BFF8F82C73890243635A4E6F6BE29063FF4E41F3035C97636B99E6F91CCF711F0B48A21555C4ED84400CBEE84152AA245BEF7C6396F11EC6
Malicious:	false
Preview:	8f3f95e347f711c7c92f1a692d6ce1915627447defc49b587ebf6a5073efb9e7 en-US/aadcloudap.dll.mui.c20bd71ff07f98477f1fc7c1990c80aed0e60c3768b7f229acfa7286293a29d6 en-US/aadtb.dll.mui.06cee7c3dd9f4fe48a7a1050a7be3f8dc294625d5511a8cd9ab51374451c6503 en-US/aadWamExtension.dll.mui.d82af48cb0e3a76c01dabaa6506ad9a130fb0a38dc5cc8d9fa5c0f239c7ef672 en-US/AboutSettingsHandlers.dll.mui.47a07b5fc2b4a56090e4ec0e5dcd37d788f8f91371ae6766c58ae34dcc42b86e en-US/accessibilitycpl.dll.mui.cc52234329ba0f35f2b5f81bcc8b35d6dbe2f87bc41a8c310b7c7d53d5d71aa3 en-US/AccountAccessor.dll.mui.413f96a418cb3cbcd97fd9dd8a645547cb94a1d2d3dffe72a3770f1e4dc99ec8 en-US/AccountsRT.dll.mui.4ce1031f1547a268103f60fe57aeb61efe45743369254878c28969a603d4218e en-US/acledit.dll.mui.066f09f0acb78ee34f295c353f74b597108d0866bf48eed03bd29162031070c0 en-US/aclui.dll.mui.0aca2a811c1936c4201c86743a717dc1ef715ec37d06236a743d2e7818f65737 en-US/acppage.dll.mui.1a786782e1f158a8981f27b06044181c79581051f2e0f20a673218490c2d8def en-US/acproxy

C:\Users\user\AppData\Local\Temp\_MEI68642\pyarmor_runtime.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	620032
Entropy (8bit):	6.1916778134841906
Encrypted:	false
SSDEEP:	12288:qTlIttemLwKXcuFdcj7fUoPHlttNynEGyEC:q5w/cuFdcj7fUoPHlttNynH
MD5:	149DBFEB76B9F8F6B7DDDE1EAAC61118
SHA1:	747DB9BF10E9231DEB2CB2619C5ECF89B7DB6232
SHA-256:	1CEBFDD7C65B99DC6EE477BFAD9F236940EAA8C0383A90A68EE467D32411C01F
SHA-512:	92BF3BF0A7E41CB06958E4AC23665E324A3220BFD49C2FAA366C9DD37E39F95770559F75285B38E3F15B0C8D5829D8BBBD7EA4ACD9F31A2CCBB53A428DA34FB4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........r...h..0..........a.............................P.......o........ .........................................]........2..............p#...........@..................................(.......................`............................text...h...........................`.P`.data....H.......J..................@.`..rdata.......@......................@.`@.pdata..p#.......$..................@.0@.xdata...%...0...&..................@.0@.bss.....f...`........................`..edata..]............8..............@.0@.idata...2.......4...:..............@.0..CRT....X.... .......n..............@.@..tls.........0.......p..............@.@..reloc.......@.......r..............@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\pyarmor_runtime_000000\pyarmor_runtime.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	620032
Entropy (8bit):	6.1916778134841906
Encrypted:	false
SSDEEP:	12288:qTlIttemLwKXcuFdcj7fUoPHlttNynEGyEC:q5w/cuFdcj7fUoPHlttNynH
MD5:	149DBFEB76B9F8F6B7DDDE1EAAC61118
SHA1:	747DB9BF10E9231DEB2CB2619C5ECF89B7DB6232
SHA-256:	1CEBFDD7C65B99DC6EE477BFAD9F236940EAA8C0383A90A68EE467D32411C01F
SHA-512:	92BF3BF0A7E41CB06958E4AC23665E324A3220BFD49C2FAA366C9DD37E39F95770559F75285B38E3F15B0C8D5829D8BBBD7EA4ACD9F31A2CCBB53A428DA34FB4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........r...h..0..........a.............................P.......o........ .........................................]........2..............p#...........@..................................(.......................`............................text...h...........................`.P`.data....H.......J..................@.`..rdata.......@......................@.`@.pdata..p#.......$..................@.0@.xdata...%...0...&..................@.0@.bss.....f...`........................`..edata..]............8..............@.0@.idata...2.......4...:..............@.0..CRT....X.... .......n..............@.@..tls.........0.......p..............@.@..reloc.......@.......r..............@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\python39.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4523976
Entropy (8bit):	6.435919894293302
Encrypted:	false
SSDEEP:	98304:Grk4ZPyKFv2bwgdGGtudvURuHRMXIwzXT:GrjZKKFehdGGt5XlXT
MD5:	19E6D310C1BD0578D468A888D3EC0E3D
SHA1:	32561AD9B89DC9E9A086569780890AD10337E698
SHA-256:	F4609EC3BBCC74ED9257E3440EC15ADF3061F7162A89E4E9A370E1C2273370A1
SHA-512:	4A8332C22A40A170EA83FC8CFD5B8A0ED0DF1D59FD22EBE10088BA0BE78CC0E91A537D7085549A4D06204CBE77E83154A812DAED885C25AA4B4CB4ACA5B9CC85
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F....\|...\|...\|..P....\|..d....\|..P....\|..P....\|..P....\|....h..\|.......\|...\|..Y}.......\|.......\|.......\|.......\|..Rich.\|..........PE..d...l.;b.........." ......#...#.....0.........................................G.....":E...`..........................................I=.......>.\|....0G.......D..8....D......@G..v...Y%.T...........................@Z%.8.............#.h............................text...$.#.......#................. ..`.rdata...S....#..T....#.............@..@.data........@>.......>.............@....pdata...8....D..:...,B.............@..@.rsrc........0G......fD.............@..@.reloc...v...@G..x...pD.............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\pywin32_system32\pywintypes39.dll

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	6.0017332542566715
Encrypted:	false
SSDEEP:	3072://ZCM+lst/TPZa4TjDY/r06trJhQAjkYe1K6SXxKpjAjfMG://ZCplst/TPnY/rxt6A4Ye1KbXYpEjf
MD5:	F20FD2E2AC9058A9FD227172F8FF2C12
SHA1:	89EBA891352BE46581B94A17DB7C2EDE9A39AB01
SHA-256:	20BDE8E50E42F7AABF59106EEA238FCC0DECE0C6E362C0A7FEEB004AB981DB8A
SHA-512:	42A86FA192AEA7ADB4283DC48A323A4F687DAD40060EA3FFDDCD8FD7670BB535D31A7764706E5C5473DA28399FEC048AE714A111EE238BB25E1AAD03E12078D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.$.X.w.X.w.X.w. Kw.X.w.-.v.X.w.7%w.X.w.-.v.X.w.-.v.X.w.-.v.X.w.3.v.X.wY1.v.X.w.3.v.X.w.X.w&X.w.-.v.X.w.-.v.X.w.-.v.X.wRich.X.w........PE..d......d.........." .........................................................P............`..........................................u..`B..p...,....0..d.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..\...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...d....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\select.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29640
Entropy (8bit):	6.24629892386138
Encrypted:	false
SSDEEP:	768:g2YyAU1265whJBHqgORWZI57GZYiSyvwhT:v86Gh/KgORWZI57GZ7Syo
MD5:	196C4D2F8BDC9E9D2DBCCE866050684C
SHA1:	1166C85C761D8188C45D9CC7441ABFE8A7071132
SHA-256:	CD31F9F557D57A6909186940EAFE483C37DE9A7251E604644A747C7EC26B7823
SHA-512:	CB9A02530721482F0FF912CA65DAE94F6930676E2390CB5523F99452174622D7E2E70CAFAF46E053F0C3DFC314EDC8C2F4FD3BC7EA888BE81E83FF40D3A30E78
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... ...N...N...N.......N...O...N...K...N...J...N...M...N.O.O...N...O...N.!.O...N.O.C...N.O.N...N.O.....N.O.L...N.Rich..N.........................PE..d.....;b.........." ....."...4......................................................3<....`..........................................Q..L....R..x............p..T....T..........D....B..T...........................0C..8............@..(............................text.... .......".................. ..`.rdata..J....@.......&..............@..@.data........`.......B..............@....pdata..T....p.......D..............@..@.rsrc................H..............@..@.reloc..D............R..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1122248
Entropy (8bit):	5.37506480885596
Encrypted:	false
SSDEEP:	12288:CezMmuZ63NhQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uoUT:CezuiZV0m88MMREtV6Vo4uYoUT
MD5:	684AE6992F55AD6C64588367E42F44F7
SHA1:	66D8868286924ADA60966A620DFFE87B2C978711
SHA-256:	91834E28CC0ACBD966DC6D323B95113E0050301B7CD6CD4ABE43390F2BBDDB34
SHA-512:	70453EE98CBF6365AA7A326520CDAD438D6A1D6F463DA6180CB5E20708647951831D232B577BE50A16825912A9E40386C64A9987E3265FC870CDDD918B31614C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".$~fOJ-fOJ-fOJ-o7.-`OJ-4:K,dOJ-4:O,jOJ-4:N,nOJ-4:I,eOJ-.:K,eOJ-.=K,dOJ-fOK-,OJ-.:G,gOJ-.:J,gOJ-.:.-gOJ-.:H,gOJ-RichfOJ-........PE..d.....;b.........." .....J..........T).......................................@............`.............................................X...h........ .......................0......`L..T............................L..8............`...............................text....I.......J.................. ..`.rdata.."....`.......N..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	5.851469350935171
Encrypted:	false
SSDEEP:	3072:pI+kHubb2wCc8Rd0BvDAQolRVFhLaNKPNyymA4FZ5dorG0e:ShObbac8Rd0BUlRVlPNynFZ57
MD5:	05E4B3B876E5FA6A2B8951F764559623
SHA1:	4AD50F70EEF4FEAA9D051C2F161FBAC8A862A4BC
SHA-256:	A52F8BD28B5B9558CDE10333CE452A7D6F338CE1005A2B8451755005868E4A98
SHA-512:	5648306AF7C056C9250731B7D5A508664294BBB8BA865F9DC06FD7216ADF7B8CC31B1CFBC0175C7F2752680744F6546A1959E7F7D1EC7A8A845F75642CE034D9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.uV0...0...0...9...8...b...4...b...8...b...4.......2.......2...b...'...$...;...0...g.......2.......1.......1...Rich0...................PE..d......d.........." .........................................................P............`..........................................................0..T....................@..$....v..T............................<..8............0..........@....................text............................... ..`.rdata......0......................@..@.data...x(......."..................@....pdata..............................@..@.rsrc...T....0......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI68642\win32event.pyd

Download File

Process:	C:\Users\user\Desktop\datasett.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	5.566183037243278
Encrypted:	false
SSDEEP:	768:pu2z3oHKLNA/jhfWddbcrsdcBi60k/MwJba:pXkHkNA/jhfWddbcBBi60k/MwJba
MD5:	E4C515DF1FEDF6BC59E7FED6AB194E00
SHA1:	B26384AEC2EE25EE59CD45FB77AC04A3FB46A80F
SHA-256:	E469C3E9A6836CE38DEA05854D27CAA33EB766882527F73F60E3E2254BADC51B
SHA-512:	123D16456B86C406F23C366349DF5785D9CC793ADBBBB7CF50B64B318C16F5FE703B600A3C67A979319BC779049F786F4AD675C22B1973FA712C6623695E7EF7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.*..uD..uD..uD......uD.F.E..uD.F.A..uD.F.@..uD.F.G..uD...E..uD..E..uD...E..uD..uE.NuD...M..uD...D..uD...F..uD.Rich.uD.........................PE..d......d.........." .....8...4.......3....................................................`..........................................f..T...4g..........\............................Z..T............................Z..8............P...............................text...86.......8.................. ..`.rdata...#...P...$...<..............@..@.data................`..............@....pdata...............d..............@..@.rsrc...\............j..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.991122285185765
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	datasett.exe
File size:	11'185'705 bytes
MD5:	3a90d6fa7c4cccd6ec03eb0667807b5b
SHA1:	3c88e16a010d5b464be251107bfb17de08daa445
SHA256:	339b04f57ff45915e7eb52ec9dca9bc85375a13028ade3d310a357fb79c4e5b0
SHA512:	2c3cb4f8ce17fb304313d6a6cd7c2ad8bceb5a0a4fcd533d0b33ab012d1b5d02ecb7ba82f2eebe821206bf77e33180f131f35624aae3e071a70bb10a2d59aa07
SSDEEP:	196608:l2aeDhL2Vmd6+DdfpJVAzDaku9QmEQxzKEp042pOUJ1MiRQXu9oZCP0U2fK7/j:PuhL2Vmd6mfJVAzDakhrQZhp042EAGXI
TLSH:	0EB63348369008A2F4A71036CD61D532D57EB41DB687C9FF86B196A00F67AF3E877B60
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6_..W1..W1..W1../2..W1../4.)W1../5..W1..+...W1..+4..W1..+5..W1..+2..W1../0..W1..W0..W1.W+5..W1.W+3..W1.Rich.W1.........PE..d..

File Icon


Icon Hash:	0f338dd65663330f

Static PE Info

General

Entrypoint:	0x14000b310
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66411729 [Sun May 12 19:23:21 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	0b5552dccd9d0a834cea55c0c8fc05be

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FF74518E8CCh
dec eax
add esp, 28h
jmp 00007FF74518E4DFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FF74518EE44h
test eax, eax
je 00007FF74518E683h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FF74518E667h
dec eax
cmp ecx, eax
je 00007FF74518E676h
xor eax, eax
dec eax
cmpxchg dword ptr [0004121Ch], ecx
jne 00007FF74518E650h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FF74518E659h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [00041207h]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [000411F7h], al
call 00007FF74518EC43h
call 00007FF74518FD72h
test al, al
jne 00007FF74518E666h
xor al, al
jmp 00007FF74518E676h
call 00007FF74519C351h
test al, al
jne 00007FF74518E66Bh
xor ecx, ecx
call 00007FF74518FD82h
jmp 00007FF74518E64Ch
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000411BCh], 00000000h
mov ebx, ecx
jne 00007FF74518E6C9h
cmp ecx, 01h
jnbe 00007FF74518E6CCh
call 00007FF74518EDAAh
test eax, eax
je 00007FF74518E68Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3bd0c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x11228	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x4e000	0x20c4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x64000	0x758	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39480	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39340	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x418	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28800	0x28800	443d51fb84559b563832949912f06b00	False	0.5583465952932098	data	6.488023200564254	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0x12b16	0x12c00	c03e344b6f216f4bba5aafc8b12c08c3	False	0.5154817708333334	data	5.824669117167863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x103f8	0xe00	afabb66fdcd2825de5909f10c900fca7	False	0.13309151785714285	DOS executable (block device driver \377\3)	1.8096886543499544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x4e000	0x20c4	0x2200	7b210ceebebc00c96d1c55c2b456bbb4	False	0.47794117647058826	data	5.274096406482418	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x51000	0x15c	0x200	c059b775abce97446903f3597b027fae	False	0.384765625	data	2.808567494642619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x52000	0x11228	0x11400	79a551190dcc027e614e45a9fffaf10d	False	0.20028023097826086	data	3.223763623407736	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x64000	0x758	0x800	11aaafc72361ec8886a740c3e209ceb3	False	0.544921875	data	5.2576643703968475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x52130	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 60472 x 60472 px/m	0.19016917070862416
RT_GROUP_ICON	0x62958	0x14	data	1.15
RT_VERSION	0x6296c	0x2e4	data	0.45675675675675675
RT_MANIFEST	0x62c50	0x5d7	XML 1.0 document, ASCII text, with CRLF line terminators	0.45217391304347826

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, IsValidCodePage, GetACP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetOEMCP, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetEndOfFile, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 16:47:01.285064936 CET	49731	443	192.168.2.4	104.26.3.46
Dec 24, 2024 16:47:01.285152912 CET	443	49731	104.26.3.46	192.168.2.4
Dec 24, 2024 16:47:01.285264015 CET	49731	443	192.168.2.4	104.26.3.46
Dec 24, 2024 16:47:01.299833059 CET	49731	443	192.168.2.4	104.26.3.46
Dec 24, 2024 16:47:01.299905062 CET	443	49731	104.26.3.46	192.168.2.4
Dec 24, 2024 16:47:02.537151098 CET	443	49731	104.26.3.46	192.168.2.4
Dec 24, 2024 16:47:02.537796974 CET	49731	443	192.168.2.4	104.26.3.46
Dec 24, 2024 16:47:02.537859917 CET	443	49731	104.26.3.46	192.168.2.4
Dec 24, 2024 16:47:02.539015055 CET	443	49731	104.26.3.46	192.168.2.4
Dec 24, 2024 16:47:02.539084911 CET	49731	443	192.168.2.4	104.26.3.46
Dec 24, 2024 16:47:02.539706945 CET	49731	443	192.168.2.4	104.26.3.46
Dec 24, 2024 16:47:02.539838076 CET	443	49731	104.26.3.46	192.168.2.4
Dec 24, 2024 16:47:02.539874077 CET	49731	443	192.168.2.4	104.26.3.46
Dec 24, 2024 16:47:02.539911032 CET	49731	443	192.168.2.4	104.26.3.46

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 16:47:00.823235035 CET	57914	53	192.168.2.4	1.1.1.1
Dec 24, 2024 16:47:01.279517889 CET	53	57914	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 16:47:00.823235035 CET	192.168.2.4	1.1.1.1	0xe1d	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 16:47:01.279517889 CET	1.1.1.1	192.168.2.4	0xe1d	No error (0)	iplogger.org	104.26.3.46	A (IP address)	IN (0x0001)	false
Dec 24, 2024 16:47:01.279517889 CET	1.1.1.1	192.168.2.4	0xe1d	No error (0)	iplogger.org	104.26.2.46	A (IP address)	IN (0x0001)	false
Dec 24, 2024 16:47:01.279517889 CET	1.1.1.1	192.168.2.4	0xe1d	No error (0)	iplogger.org	172.67.74.161	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	10:46:56
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\datasett.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\datasett.exe"
Imagebase:	0x7ff799670000
File size:	11'185'705 bytes
MD5 hash:	3A90D6FA7C4CCCD6EC03EB0667807B5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	10:46:58
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\datasett.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\datasett.exe"
Imagebase:	0x7ff799670000
File size:	11'185'705 bytes
MD5 hash:	3A90D6FA7C4CCCD6EC03EB0667807B5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:47:01
Start date:	24/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c schtasks /create /sc MINUTE /mo 15 /tn "VirboUpd" /tr "C:\Users\user\Desktop\datasett.exe" /f
Imagebase:	0x7ff6fb660000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:47:01
Start date:	24/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:47:01
Start date:	24/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /sc MINUTE /mo 15 /tn "VirboUpd" /tr "C:\Users\user\Desktop\datasett.exe" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:47:01
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\datasett.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\datasett.exe
Imagebase:	0x7ff799670000
File size:	11'185'705 bytes
MD5 hash:	3A90D6FA7C4CCCD6EC03EB0667807B5B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:47:04
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\datasett.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\datasett.exe
Imagebase:	0x7ff799670000
File size:	11'185'705 bytes
MD5 hash:	3A90D6FA7C4CCCD6EC03EB0667807B5B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	25

Executed Functions

Function 00007FF799694E20 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF799694E65

Part of subcall function 00007FF7996947B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7996947CC

Part of subcall function 00007FF799689E18: RtlFreeHeap.NTDLL(?,?,?,00007FF799691E42,?,?,?,00007FF799691E7F,?,?,00000000,00007FF799692345,?,?,?,00007FF799692277), ref: 00007FF799689E2E
Part of subcall function 00007FF799689E18: GetLastError.KERNEL32(?,?,?,00007FF799691E42,?,?,?,00007FF799691E7F,?,?,00000000,00007FF799692345,?,?,?,00007FF799692277), ref: 00007FF799689E38

Part of subcall function 00007FF799689DD0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF799689DAF,?,?,?,?,?,00007FF7996821EC), ref: 00007FF799689DD9
Part of subcall function 00007FF799689DD0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF799689DAF,?,?,?,?,?,00007FF7996821EC), ref: 00007FF799689DFE

_get_daylight.LIBCMT ref: 00007FF799694E54

Part of subcall function 00007FF799694818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79969482C

_get_daylight.LIBCMT ref: 00007FF7996950CA
_get_daylight.LIBCMT ref: 00007FF7996950DB
_get_daylight.LIBCMT ref: 00007FF7996950EC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF79969532C), ref: 00007FF799695113

Strings

Eastern Summer Time, xrefs: 00007FF7996951D1
Eastern Standard Time, xrefs: 00007FF7996951B9

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 77ba2d10f7a40a17f98ee8fd01e8c058cff67636c36494bf754a44884999314e
Instruction ID: d0c64f92b03ce063efc61caa5fbfd9126005503111557e4eeace3bce4477d8ee
Opcode Fuzzy Hash: 77ba2d10f7a40a17f98ee8fd01e8c058cff67636c36494bf754a44884999314e
Instruction Fuzzy Hash: 78D1AD26A1825286FB34BF36D4501B9A7B3FF89794FC44136EA2D47785EE3CE4418760

Function 00007FF799695D6C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF799695AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF799695AE1
Part of subcall function 00007FF799695AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF799695B5F
Part of subcall function 00007FF799695AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF799695BB0

CreateFileW.KERNELBASE ref: 00007FF799695E72
CreateFileW.KERNEL32 ref: 00007FF799695EC2
GetLastError.KERNEL32 ref: 00007FF799695EF2
GetFileType.KERNELBASE ref: 00007FF799695F07
GetLastError.KERNEL32 ref: 00007FF799695F11
CloseHandle.KERNEL32 ref: 00007FF799695F44
CloseHandle.KERNEL32 ref: 00007FF7996960A7
CreateFileW.KERNEL32 ref: 00007FF7996960DC
GetLastError.KERNEL32 ref: 00007FF7996960EB

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction ID: 76c5159c61e54c6556610012250eb58183f845362fea9be6cddc1d9cc7974633
Opcode Fuzzy Hash: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction Fuzzy Hash: D1C1A136B28A4186FB20EF79C4906BC7772FB49BA8B811225DE2E57795CF39D055C310

Function 00007FF799676780 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,00000000,?,00007FF79967674D), ref: 00007FF79967681A

Part of subcall function 00007FF799676990: GetEnvironmentVariableW.KERNEL32(00007FF7996736E7), ref: 00007FF7996769CA
Part of subcall function 00007FF799676990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7996769E7

Part of subcall function 00007FF7996866B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7996866CD

SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7996768D1

Part of subcall function 00007FF799672770: MessageBoxW.USER32 ref: 00007FF799672841

Strings

_MEI%d, xrefs: 00007FF799676828
TMP, xrefs: 00007FF7996767DE
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF7996767F8
TMP, xrefs: 00007FF7996767B8, 00007FF799676879, 00007FF799676907

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: f0ff48578907a1126a2fb3b3d0e0d3ed1b6e9341558fecceb6b7a90a7f9efa5b
Instruction ID: 02a091232d3149b8b7e38a7a3a7628040d552616b5e591573fc4e96bb90ae0b1
Opcode Fuzzy Hash: f0ff48578907a1126a2fb3b3d0e0d3ed1b6e9341558fecceb6b7a90a7f9efa5b
Instruction Fuzzy Hash: 30516A11B1D74381FA74BF72A9552BAD6B39F49BC0FC44035ED2E87796ED2DE4018221

Function 00007FF79969509C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7996950CA

Part of subcall function 00007FF799694818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79969482C

_get_daylight.LIBCMT ref: 00007FF7996950DB

Part of subcall function 00007FF7996947B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7996947CC

_get_daylight.LIBCMT ref: 00007FF7996950EC

Part of subcall function 00007FF7996947E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7996947FC

Part of subcall function 00007FF799689E18: RtlFreeHeap.NTDLL(?,?,?,00007FF799691E42,?,?,?,00007FF799691E7F,?,?,00000000,00007FF799692345,?,?,?,00007FF799692277), ref: 00007FF799689E2E
Part of subcall function 00007FF799689E18: GetLastError.KERNEL32(?,?,?,00007FF799691E42,?,?,?,00007FF799691E7F,?,?,00000000,00007FF799692345,?,?,?,00007FF799692277), ref: 00007FF799689E38

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF79969532C), ref: 00007FF799695113

Strings

Eastern Summer Time, xrefs: 00007FF7996951D1
Eastern Standard Time, xrefs: 00007FF7996951B9

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 74e2aae664cff904285b8cceaf5bd78e264b53cf78d1017760ee0a7f729cca6e
Instruction ID: bea1e538932d6a17f01d0824186748f24f125251d00e12d6502499636105928c
Opcode Fuzzy Hash: 74e2aae664cff904285b8cceaf5bd78e264b53cf78d1017760ee0a7f729cca6e
Instruction Fuzzy Hash: F7516B72A1864286F730FF31E9901A9E7B2BB88784FC44136EA6D47696DF3CE4018760

Function 00007FF79968FA08 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 0acdd9e309cfeb04828d1c66f74c4088768a5d3a74191b7ea8684e639bf01185
Instruction ID: 8f4b32546689673eeaa1adeb5540602d7abf90a85eb63a8f5ff790b9b4a51710
Opcode Fuzzy Hash: 0acdd9e309cfeb04828d1c66f74c4088768a5d3a74191b7ea8684e639bf01185
Instruction Fuzzy Hash: 71029E22A0D642C1FA74BF3A9404279E6B2AF46BA0FD44635DE7D477D2EE3DA4118370

Function 00007FF7996717B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF79967185C
_fread_nolock.LIBCMT ref: 00007FF79967190E

Part of subcall function 00007FF79967F370: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79967F384

Part of subcall function 00007FF799672770: MessageBoxW.USER32 ref: 00007FF799672841

Strings

Failed to seek to cookie position!, xrefs: 00007FF79967182F
malloc, xrefs: 00007FF7996718EA
fseek, xrefs: 00007FF799671836
MEI, xrefs: 00007FF7996717EF
Could not read full TOC!, xrefs: 00007FF799671919
Failed to read cookie!, xrefs: 00007FF799671867
Could not allocate buffer for TOC!, xrefs: 00007FF7996718E3
Cannot read Table of Contents., xrefs: 00007FF799671995
fread, xrefs: 00007FF79967186E
Error on file., xrefs: 00007FF79967193D

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: 89b0be782711f6ea6e2647f2b9cebeab1cc80561cce721b8eca3f4fc52a5b3ef
Instruction ID: 1520e5281ff2c77a7063f22a4efbb2fe4d32ca804f443b4e6700fccbcb388c44
Opcode Fuzzy Hash: 89b0be782711f6ea6e2647f2b9cebeab1cc80561cce721b8eca3f4fc52a5b3ef
Instruction Fuzzy Hash: 89514C72A1970286FB64EF38D454178B3B2EB48B48B918136DA2D87799DF3CE541C760

Function 00007FF799671440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fwrite, xrefs: 00007FF7996715DC
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7996715D5
fopen, xrefs: 00007FF799671491
malloc, xrefs: 00007FF799671560
fseek, xrefs: 00007FF799671500
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7996715E5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7996714F9
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7996714CA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF799671559
Failed to extract %s: failed to open target file!, xrefs: 00007FF79967148A
fread, xrefs: 00007FF7996715EC

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: a0da00e948d8bf5ab75f65998a8982b5789af3fcbcffcd26f02d9795f42b9c94
Instruction ID: 431e0b96d680a771f388b5a51257a13207570ef71a798b34e7d1a9979dfd1b16
Opcode Fuzzy Hash: a0da00e948d8bf5ab75f65998a8982b5789af3fcbcffcd26f02d9795f42b9c94
Instruction Fuzzy Hash: AA518865A0974281FA30BF35E5046B9A3B2AF45BD4FC54132DE2D4779AEE3CE6858320

Function 00007FF7996778A0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF79967685A,?,00007FF79967674D), ref: 00007FF7996778E0
OpenProcessToken.ADVAPI32(?,00007FF79967674D), ref: 00007FF7996778F1
GetTokenInformation.KERNELBASE(?,00007FF79967674D(TokenIntegrityLevel)), ref: 00007FF799677913
GetLastError.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF79967791D
GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel), ref: 00007FF79967795A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF79967796C
CloseHandle.KERNEL32(?,00007FF79967674D), ref: 00007FF799677984
LocalFree.KERNEL32(?,00007FF79967674D), ref: 00007FF7996779B6
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF7996779DD
CreateDirectoryW.KERNELBASE(?,00007FF79967674D), ref: 00007FF7996779EE

Strings

S-1-3-4, xrefs: 00007FF79967798F
D:(A;;FA;;;%s), xrefs: 00007FF799677999

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 2e28230f75d657313d5b30c4cdf08458408b558478e57b477a7299d9920cfa6e
Instruction ID: bd43be5a739e1a3535ed1efa13e83dda88ec5f39b319a310027c49806a7e4c46
Opcode Fuzzy Hash: 2e28230f75d657313d5b30c4cdf08458408b558478e57b477a7299d9920cfa6e
Instruction Fuzzy Hash: 32412D3261C78282FA60AF71E4446BAB3B6FB84794F841231EA6E476D5DF3CD544CB60

Function 00007FF799676FD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF799677A30: MultiByteToWideChar.KERNEL32 ref: 00007FF799677A6A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF799673A30), ref: 00007FF79967701F
GetStartupInfoW.KERNEL32 ref: 00007FF79967703E

Part of subcall function 00007FF799689184: _invalid_parameter_noinfo.LIBCMT ref: 00007FF799689198

Part of subcall function 00007FF799686EF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF799686F5F

GetCommandLineW.KERNEL32 ref: 00007FF7996770DE
CreateProcessW.KERNELBASE ref: 00007FF799677120
WaitForSingleObject.KERNEL32 ref: 00007FF799677134
GetExitCodeProcess.KERNEL32 ref: 00007FF799677144

Strings

Error creating child process!, xrefs: 00007FF799677150
CreateProcessW, xrefs: 00007FF799677157

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
Instruction ID: 79b6dad35cb22db326f8145af2da43cd9f45299fe4a82114171f3c423a65f971
Opcode Fuzzy Hash: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
Instruction Fuzzy Hash: 7B410D32A0878286EA20AF71E4552AAE3B5EB95364F900335E6BD47BD5DF7CD044CB50

Function 00007FF799671000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF799673BA0: GetModuleFileNameW.KERNEL32(?,00007FF799673699), ref: 00007FF799673BD1

SetDllDirectoryW.KERNEL32 ref: 00007FF7996738A5

Part of subcall function 00007FF799676990: GetEnvironmentVariableW.KERNEL32(00007FF7996736E7), ref: 00007FF7996769CA
Part of subcall function 00007FF799676990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7996769E7

Strings

_PYI_ONEDIR_MODE, xrefs: 00007FF7996736FC, 00007FF799673727
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF79967382C
MEI, xrefs: 00007FF7996737E7
Failed to convert DLL search path!, xrefs: 00007FF79967388D
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF79967378E
_MEIPASS2, xrefs: 00007FF7996736D3, 00007FF79967373C, 00007FF7996739EB, 00007FF7996739FB

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 44b475a59b26ac604398257d32b032ffcccbc2e891c2c812d1ce445b27ff6486
Instruction ID: 17648c3f57edaf7d73939be241e71ec42d2b6b071b4714ccadf525874e1cfd54
Opcode Fuzzy Hash: 44b475a59b26ac604398257d32b032ffcccbc2e891c2c812d1ce445b27ff6486
Instruction Fuzzy Hash: A4B18F21A1C78355FA70BF31A9516FDA2B2BF44784FC0013AEA6D47796EE2CE6048730

Function 00007FF799671050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7996710F1
malloc, xrefs: 00007FF7996710F8, 00007FF799671126
1.2.13, xrefs: 00007FF79967107E
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF799671249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7996710B4
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF79967111F

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: 833a19a7183c3a67044c39a1e7c8a53260805929faaaf04ce1acbdda8b337b7b
Instruction ID: f57c4f518c918a6e20799b0583e1d9bb7b7502fd1792ec44fdb04e568c8c42f8
Opcode Fuzzy Hash: 833a19a7183c3a67044c39a1e7c8a53260805929faaaf04ce1acbdda8b337b7b
Instruction Fuzzy Hash: A551B332A0978285FA30BF71E4403BAA2B2FB84798F954136DE6D47795EE3CE585C710

Function 00007FF79968AF2C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79968B359

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 184652ea66a00c646f0d6e367f8fa0d47b8fb75159f9cd0cc9461bb9675fa9ff
Instruction ID: 86794c04b9ad55259dcab2fc59ee1da035b8b22dfdb04dc0f5ab28f01c238609
Opcode Fuzzy Hash: 184652ea66a00c646f0d6e367f8fa0d47b8fb75159f9cd0cc9461bb9675fa9ff
Instruction Fuzzy Hash: C1C1B232A1C686C2F671AF36A4502BDFBB2EBC5B80F990131DA6D07791DE7DE4458320

Function 00007FF79968C430 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF79968C41B), ref: 00007FF79968C54C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF79968C41B), ref: 00007FF79968C5D7

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction ID: 30e1ae8f8c507c5048c9ea03a093e4303d58a9be075483731615929946d2bb71
Opcode Fuzzy Hash: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction Fuzzy Hash: DA91F362E08652C5F770AF3694402BDEBB2BB54B88F941139DE1E63A84DF3DD481C720

Function 00007FF79968E8DC Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF79968E9CC
_get_daylight.LIBCMT ref: 00007FF79968E9DD
_get_daylight.LIBCMT ref: 00007FF79968E9EE
_isindst.LIBCMT ref: 00007FF79968EAB9

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
Instruction ID: e92c1dbe71704b4ad52ac3e1861d64b67b3d45503ff5c413f7315d4876d9ea63
Opcode Fuzzy Hash: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
Instruction Fuzzy Hash: D0513672F046119AFB34FF3599412BCE7B2BB20758F944236ED2E52AE5DB3CA4028710

Function 00007FF7996847D4 Relevance: 6.1, APIs: 4, Instructions: 119
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 00007FF799684807
GetFileInformationByHandle.KERNELBASE ref: 00007FF799684869
GetLastError.KERNEL32 ref: 00007FF7996848FA
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF79968470C), ref: 00007FF799684946

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
Instruction ID: 2f4463b02272823199f381ae2541845f89a0b6f59e2d5a136eda8eefcafe236e
Opcode Fuzzy Hash: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
Instruction Fuzzy Hash: 21517D63E086418AFB20EF72D4503BDB3B2AB48B98F954535DE2D57689DF38D4518320

Function 00007FF79967B19C Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF79967B1AB

Part of subcall function 00007FF79967B36C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF79967B38E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF79967B1C0
__scrt_release_startup_lock.LIBCMT ref: 00007FF79967B22E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF79967B281

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction ID: ef98173b451e7d1330a28b0dce26b1527f427888adae5cffd3e70a97cbe7e631
Opcode Fuzzy Hash: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction Fuzzy Hash: 4C31F321E0D20285FA74BF75A4153B9A2B3AF91784FC94035EA3E4B3D7DE2CE8459271

Function 00007FF799684680 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7996846AD
CreateFileW.KERNELBASE ref: 00007FF7996846EC
CloseHandle.KERNEL32 ref: 00007FF799684721

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: aa6a3d9890cc6a7f195a6e990ba186583f2f0d5ddde8471eaaef5ef51b0941e7
Instruction ID: f762ca71b1e01dd6d4904cb3212db958e1fba7dc521749b55fee4a5eaa0534a8
Opcode Fuzzy Hash: aa6a3d9890cc6a7f195a6e990ba186583f2f0d5ddde8471eaaef5ef51b0941e7
Instruction Fuzzy Hash: 4D418323D1878183F764AF329510379E2B2FB997A4F509334E6AC03AD5DF6CA5E08710

Function 00007FF79967F39C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79967F3E0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79967F4D7

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e6b31fcbb010569d964db91d6e465c54053a5eb593f9b70391a20bf1ad845ba7
Instruction ID: 359c939177313f5bf838d56d762ae192c8cfef23f85c4250f8bf1fe814172ced
Opcode Fuzzy Hash: e6b31fcbb010569d964db91d6e465c54053a5eb593f9b70391a20bf1ad845ba7
Instruction Fuzzy Hash: 0C51A961B0974286FA74AE3A9400A7AE2B2BF44BB4F944735DE7D477CACF3CD4018620

Function 00007FF79968B604 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,00000000,00007FF79968B79D), ref: 00007FF79968B650
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF79968B79D), ref: 00007FF79968B65A

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction ID: 9cf9790c8b63c433ebf01f5e397d80e41410f2b3d4c9795c83f2626af0fab164
Opcode Fuzzy Hash: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction Fuzzy Hash: D81182A2618B4181EA20AF36A504169E772AB85BF4FD84331EA7D477D9DF7CD0558700

Function 00007FF79968497C Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF799684891), ref: 00007FF7996849AF
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF799684891), ref: 00007FF7996849C5

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 42d85f7bbfb38a33647f37402af2049ec243a38652db21839daf1665d9964160
Instruction ID: 67b5d8e9862b8b5e74c55abd5850803be5e77436a7d202cdeb972b2f9050d793
Opcode Fuzzy Hash: 42d85f7bbfb38a33647f37402af2049ec243a38652db21839daf1665d9964160
Instruction Fuzzy Hash: D011917260C642C2FA74AF22A45107AF7B2FB85771F900236F6AD859D8EF2CD044DB20

Function 00007FF799689E18 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF799691E42,?,?,?,00007FF799691E7F,?,?,00000000,00007FF799692345,?,?,?,00007FF799692277), ref: 00007FF799689E2E
GetLastError.KERNEL32(?,?,?,00007FF799691E42,?,?,?,00007FF799691E7F,?,?,00000000,00007FF799692345,?,?,?,00007FF799692277), ref: 00007FF799689E38

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 875bb2537aa3df01b4a1e34b7b101e94a2dc47b4cb64fa0c1180c15e07a79d81
Instruction ID: dbeda37524fa50c5b5854ae42925c430ec97fecaec647612b48f2ab46d76bec2
Opcode Fuzzy Hash: 875bb2537aa3df01b4a1e34b7b101e94a2dc47b4cb64fa0c1180c15e07a79d81
Instruction Fuzzy Hash: DAE08651F0D602C3FF387FB35849039D2B35F48B81BC44034CA2D46251EE2C68458230

Function 00007FF79968A028 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF799689EA5,?,?,00000000,00007FF799689F5A), ref: 00007FF79968A096
GetLastError.KERNEL32(?,?,?,00007FF799689EA5,?,?,00000000,00007FF799689F5A), ref: 00007FF79968A0A0

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction ID: 1e0f2eefaee9c4e309e563f10448470ff90ea0ba2d22df45376155c7b613c6d4
Opcode Fuzzy Hash: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction Fuzzy Hash: DC219F21B2C64281FA70BF36A454379D6B3AF847E8FC44235DA3E477D2DE6CA4458320

Function 00007FF79968B37C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79968B3A4

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ce9b52f680c1b5a7cbc95938458c13a1dbec8158119413affe32dcc0b3335035
Instruction ID: 35a90b5fe2d3c6857cdd0120ef2336a50a6dda7400d0510dc451b3adbe2297be
Opcode Fuzzy Hash: ce9b52f680c1b5a7cbc95938458c13a1dbec8158119413affe32dcc0b3335035
Instruction Fuzzy Hash: A541C332918601C7FA34EE36A551279F3B2EB96B41F981131D7AE936D5CF2CE402C761

Function 00007FF799677200 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7996772AA

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: b10f482a5bee1f93672b7d5764375bcfac5251fcf26074c2ebbef45581cba22d
Instruction ID: a557b2267482cd5e8ac648d8fb001619fb6baf0d9ce33e83678803ef10fac7ee
Opcode Fuzzy Hash: b10f482a5bee1f93672b7d5764375bcfac5251fcf26074c2ebbef45581cba22d
Instruction Fuzzy Hash: F9218221B1979185FA31BE3269047BAE6A7BF45BD4FC84430EE2D07786CE7DE141C620

Function 00007FF79968AE0C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79968AE92

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 47f2cb7360056a46563935c31beadd7a45ae652dec1b657f4a22353b163fa2db
Instruction ID: c8791a88574331bda70ec47f18630e900064c4328027a1a39bca146c3aea5c51
Opcode Fuzzy Hash: 47f2cb7360056a46563935c31beadd7a45ae652dec1b657f4a22353b163fa2db
Instruction Fuzzy Hash: 0C319A22A18A52C1F771BF768800378E6B2AB84BA0FC10635EA3D037D2DF7CA4418731

Function 00007FF7996854C8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79968542D

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction ID: 19b1c3514b8161615b6b0f7be0a662435f2f2cc3a15f0a27e21e0f4a7c588c71
Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction Fuzzy Hash: B1114D22A1D681C1FB70BF6394006B9E2B2EF85B80FC44471EAAC57A96DF7CD4408765

Function 00007FF79969575C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79969577F

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction ID: afb4cb9c84c4b16672b249610fa4c043537a43d8cb9933a40348c3cdc68e5ab2
Opcode Fuzzy Hash: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction Fuzzy Hash: 68219232A18A4187EB71AF29E440379B6B2EB84B94F944235EB6D476D9DF3DD5008B10

Function 00007FF79967F61C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79967F670

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction ID: 1e1809824cadbbab094565f335c9ee9a554a4d9770c799cf128da6c9ccde3737
Opcode Fuzzy Hash: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction Fuzzy Hash: 07015221A0874241F924EF769A01469E6B6AB45FE4F884631DE7C57BDADE3CD4014720

Function 00007FF799686378 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7996863B6

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6f6adecfb5bad98c5c42fe003c81079e6b3f0dd6313af18c674d8974214f62bd
Instruction ID: 039a689eeea1a894860637e88426df5775e5a15eedb46335904d46d61cabacb0
Opcode Fuzzy Hash: 6f6adecfb5bad98c5c42fe003c81079e6b3f0dd6313af18c674d8974214f62bd
Instruction Fuzzy Hash: FB018C20E0DA46C2FE707F3B6641279DAB2AF057A0FD46235EA7D426C6DF7DA4418231

Function 00007FF7996866B4 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7996866CD

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 941a86941730833d6478beb8ac9be3d47737e734966101895db6565f81f02151
Instruction ID: 1eef4c2d5d0703cac96219034cad2d426e411382e25917b11ac7a81206c194cb
Opcode Fuzzy Hash: 941a86941730833d6478beb8ac9be3d47737e734966101895db6565f81f02151
Instruction Fuzzy Hash: FAE01291E09387C7FE747FB34A821B8D5329F28340FD05035DA29072C3DD2CA8849A36

Function 00007FF79968DD40 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF79968A8B6,?,?,?,00007FF799689A73,?,?,00000000,00007FF799689D0E), ref: 00007FF79968DD95

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction ID: e976644be2ce1d09281c2d8874e8c7cd721e3fe9a32ddcce93ff72a11234caff
Opcode Fuzzy Hash: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction Fuzzy Hash: 0DF0FF54B59602C3FEB97E7355613B5D6B65F89B80F885570C92D962D2DD1CF4408330

Function 00007FF79968CACC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF79967FE44,?,?,?,00007FF799681356,?,?,?,?,?,00007FF799682949), ref: 00007FF79968CB0A

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction ID: 08d29385460776f724063a97913c8b6d9de385e3289545aa7d7ddcc484018619
Opcode Fuzzy Hash: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction Fuzzy Hash: 7BF05810B1D642C5FF347EB35910275D1B64F487E0F884631D93E962C2EE2DA8808230

Non-executed Functions

Function 00007FF799673DF0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673E06
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673E45
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673E6A
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673E8F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673EB7
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673EDF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673F07
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673F2F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673F57

Strings

Py_DecRef, xrefs: 00007FF799673FCD
PyImport_ExecCodeModule, xrefs: 00007FF79967424D
Failed to get address for Py_FrozenFlag, xrefs: 00007FF799673E7C
GetProcAddress, xrefs: 00007FF799673E1F
Failed to get address for PyUnicode_Join, xrefs: 00007FF799674679
Failed to get address for Py_UTF8Mode, xrefs: 00007FF799673F99
PyObject_CallFunctionObjArgs, xrefs: 00007FF799674365
Failed to get address for PyErr_Fetch, xrefs: 00007FF7996741C9
PyErr_Clear, xrefs: 00007FF799674135
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF799673EA1
PyUnicode_AsUTF8, xrefs: 00007FF799674635
PyUnicode_Join, xrefs: 00007FF79967465D
Failed to get address for PySys_SetObject, xrefs: 00007FF7996744C1
Failed to get address for PyUnicode_Decode, xrefs: 00007FF799674601
Failed to get address for Py_BuildValue, xrefs: 00007FF799673FC1
Py_BuildValue, xrefs: 00007FF799673FA5
Py_VerboseFlag, xrefs: 00007FF799673F25
PyUnicode_Replace, xrefs: 00007FF799674685
Py_FileSystemDefaultEncoding, xrefs: 00007FF799673E3B
PySys_SetObject, xrefs: 00007FF7996744A5
Failed to get address for PyList_Append, xrefs: 00007FF7996742B9
Py_UTF8Mode, xrefs: 00007FF799673F7D
Py_SetPythonHome, xrefs: 00007FF7996740E5
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF799674219
Failed to get address for Py_SetProgramName, xrefs: 00007FF7996740D9
Failed to get address for Py_GetPath, xrefs: 00007FF7996740B1
Failed to get address for PyImport_AddModule, xrefs: 00007FF799674241
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF799674471
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF799673E18
Failed to get address for PyImport_ImportModule, xrefs: 00007FF799674291
PyUnicode_Decode, xrefs: 00007FF7996745E5
PyLong_AsLong, xrefs: 00007FF7996742ED
Failed to get address for PyList_New, xrefs: 00007FF7996742E1
Py_DontWriteBytecodeFlag, xrefs: 00007FF799673DFF
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF799674421
Failed to get address for Py_DecRef, xrefs: 00007FF799673FE9
Failed to get address for PyErr_Clear, xrefs: 00007FF799674151
PyUnicode_FromString, xrefs: 00007FF799674545
Failed to get address for PyObject_Str, xrefs: 00007FF7996743F9
Failed to get address for PyErr_Print, xrefs: 00007FF7996741A1
PyList_New, xrefs: 00007FF7996742C5
PyErr_Occurred, xrefs: 00007FF79967415D
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF799674539
PyErr_Fetch, xrefs: 00007FF7996741AD
Failed to get address for PyErr_Restore, xrefs: 00007FF7996741F1
PySys_SetArgvEx, xrefs: 00007FF799674455
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7996743D1
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF799673EC9
Failed to get address for PyDict_GetItemString, xrefs: 00007FF799674129
Py_Finalize, xrefs: 00007FF799673FF5
PyErr_NormalizeException, xrefs: 00007FF7996741FD
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF799674651
Py_SetProgramName, xrefs: 00007FF7996740BD
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF799674449
Failed to get address for Py_SetPath, xrefs: 00007FF799674089
PyObject_GetAttrString, xrefs: 00007FF7996743B5
PyUnicode_FromFormat, xrefs: 00007FF7996745BD
PyImport_ImportModule, xrefs: 00007FF799674275
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF799674381
Py_NoSiteFlag, xrefs: 00007FF799673EAD
Failed to get address for PyEval_EvalCode, xrefs: 00007FF799674511
Py_DecodeLocale, xrefs: 00007FF79967456D
Failed to get address for PyUnicode_FromString, xrefs: 00007FF799674561
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF799674269
PyObject_Str, xrefs: 00007FF7996743DD
Py_NoUserSiteDirectory, xrefs: 00007FF799673ED5
PySys_AddWarnOption, xrefs: 00007FF79967442D
Failed to get address for PyMem_RawFree, xrefs: 00007FF7996745B1
PyMem_RawFree, xrefs: 00007FF799674595
Failed to get address for Py_DecodeLocale, xrefs: 00007FF799674589
Failed to get address for Py_Initialize, xrefs: 00007FF799674061
PyObject_CallFunction, xrefs: 00007FF79967433D
Py_FrozenFlag, xrefs: 00007FF799673E60
PySys_SetPath, xrefs: 00007FF7996744CD
Py_GetPath, xrefs: 00007FF799674095
Py_UnbufferedStdioFlag, xrefs: 00007FF799673F4D
PyList_Append, xrefs: 00007FF79967429D
PySys_GetObject, xrefs: 00007FF79967447D
PyEval_EvalCode, xrefs: 00007FF7996744F5
Failed to get address for PyModule_GetDict, xrefs: 00007FF799674331
Failed to get address for PyLong_AsLong, xrefs: 00007FF799674309
Failed to get address for Py_SetPythonHome, xrefs: 00007FF799674101
PyErr_Print, xrefs: 00007FF799674185
PyErr_Restore, xrefs: 00007FF7996741D5
Failed to get address for PyObject_CallFunction, xrefs: 00007FF799674359
Py_SetPath, xrefs: 00007FF79967406D
PyUnicode_DecodeFSDefault, xrefs: 00007FF79967460D
Py_IncRef, xrefs: 00007FF79967401D
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF799674629
Failed to get address for Py_IncRef, xrefs: 00007FF799674039
Py_OptimizeFlag, xrefs: 00007FF799673EFD
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF799673F69
PyModule_GetDict, xrefs: 00007FF799674315
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF799673E57
Py_Initialize, xrefs: 00007FF799674045
PyImport_AddModule, xrefs: 00007FF799674225
PyDict_GetItemString, xrefs: 00007FF79967410D
PyObject_SetAttrString, xrefs: 00007FF79967438D
Failed to get address for PySys_GetObject, xrefs: 00007FF799674499
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF799673EF1
PyRun_SimpleStringFlags, xrefs: 00007FF799674405
PyMarshal_ReadObjectFromString, xrefs: 00007FF79967451D
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF799673F19
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF7996745D9
Failed to get address for Py_VerboseFlag, xrefs: 00007FF799673F41
Failed to get address for PyUnicode_Replace, xrefs: 00007FF7996746A1
Py_IgnoreEnvironmentFlag, xrefs: 00007FF799673E85
Failed to get address for Py_Finalize, xrefs: 00007FF799674011
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7996743A9
Failed to get address for PySys_SetPath, xrefs: 00007FF7996744E9
Failed to get address for PyErr_Occurred, xrefs: 00007FF799674179

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction ID: af28a62bc28cbfff440a094cc9098a9a928246895e0df10b99074c1d16a3e3b6
Opcode Fuzzy Hash: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction Fuzzy Hash: 40426F64A0EB0791FA75FF34B854174A2B3AF88794BC85176C92E06364EF7CF6589220

Function 00007FF799671B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF799671BDE
MulDiv.KERNEL32 ref: 00007FF799671BF2
MulDiv.KERNEL32 ref: 00007FF799671C13
SystemParametersInfoW.USER32 ref: 00007FF799671C5B
CreateFontIndirectW.GDI32 ref: 00007FF799671C6F
#380.COMCTL32 ref: 00007FF799671C93
CreateWindowExW.USER32 ref: 00007FF799671CE6
CreateWindowExW.USER32 ref: 00007FF799671D40
CreateWindowExW.USER32 ref: 00007FF799671D9D
CreateWindowExW.USER32 ref: 00007FF799671DFF
SendMessageW.USER32 ref: 00007FF799671E1F
SendMessageW.USER32 ref: 00007FF799671E39
SendMessageW.USER32 ref: 00007FF799671E58
SendMessageW.USER32 ref: 00007FF799671E77
SendMessageW.USER32 ref: 00007FF799671E95
SendMessageW.USER32 ref: 00007FF799671EB3
SendMessageW.USER32 ref: 00007FF799671ED1
SendMessageW.USER32 ref: 00007FF799671EE9
SendMessageW.USER32 ref: 00007FF799671F01
GetClientRect.USER32 ref: 00007FF799671F10

Part of subcall function 00007FF799672030: GetDC.USER32 ref: 00007FF79967205B
Part of subcall function 00007FF799672030: SelectObject.GDI32 ref: 00007FF7996720A2
Part of subcall function 00007FF799672030: DrawTextW.USER32 ref: 00007FF7996720C5
Part of subcall function 00007FF799672030: SelectObject.GDI32 ref: 00007FF7996720DB
Part of subcall function 00007FF799672030: ReleaseDC.USER32 ref: 00007FF7996720EB
Part of subcall function 00007FF799672030: MoveWindow.USER32 ref: 00007FF79967213B
Part of subcall function 00007FF799672030: MoveWindow.USER32 ref: 00007FF79967217B
Part of subcall function 00007FF799672030: MoveWindow.USER32 ref: 00007FF7996721CE

Strings

BUTTON, xrefs: 00007FF799671DB6
STATIC, xrefs: 00007FF799671C9C, 00007FF799671CF1
Close, xrefs: 00007FF799671DA8
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF799671BBD
EDIT, xrefs: 00007FF799671D4B

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction ID: 8efebc3e1171f3e2d67e87de0389b4b7f97b33dabfed5e3396ae1e20e574dc68
Opcode Fuzzy Hash: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction Fuzzy Hash: 49A17A36208B8187E724DF21E55479AB3B1F788B94F90412AEB9D43B24CF3DE1A5CB50

Function 00007FF7996931CC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF79969321A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF799693886
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7996939FC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF799693CBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF799693EDA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF799694117
memcpy_s.LIBCPMT ref: 00007FF7996941F2
memcpy_s.LIBCPMT ref: 00007FF79969429D
memcpy_s.LIBCPMT ref: 00007FF79969436C

Strings

1#INF, xrefs: 00007FF799693343
1#IND, xrefs: 00007FF799693307
1#SNAN, xrefs: 00007FF79969332A
1#QNAN, xrefs: 00007FF799693333

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 46fb5d0366b8e1e712cdd684d815614daf2c7cda5b16cac76ba58e706ef79b66
Instruction ID: 288b9120d41b075ca7edd8ee452978517ef0394587cd644b6e8e6bf7e867fef9
Opcode Fuzzy Hash: 46fb5d0366b8e1e712cdd684d815614daf2c7cda5b16cac76ba58e706ef79b66
Instruction Fuzzy Hash: 7FB2D272A182928BF7349F74D540BFDB7B2FB54788F805179DA2D57A84DB38E9008B60

Function 00007FF7996774B0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF7996726A0), ref: 00007FF7996774D7
FormatMessageW.KERNEL32(00000000,00007FF7996726A0), ref: 00007FF799677506
WideCharToMultiByte.KERNEL32 ref: 00007FF79967755C

Part of subcall function 00007FF799672620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF799677744,?,?,?,?,?,?,?,?,?,?,?,00007FF79967101D), ref: 00007FF799672654
Part of subcall function 00007FF799672620: MessageBoxW.USER32 ref: 00007FF79967272C

Strings

No error messages generated., xrefs: 00007FF799677510
Failed to encode wchar_t as UTF-8., xrefs: 00007FF799677566
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF799677579
FormatMessageW, xrefs: 00007FF799677517
PyInstaller: FormatMessageW failed., xrefs: 00007FF799677523
WideCharToMultiByte, xrefs: 00007FF79967756D

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction ID: fb7703c45835701ef563cd127fffc2657897b76f74b9e454fbf81cb824c42b0b
Opcode Fuzzy Hash: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction Fuzzy Hash: FB211071A18B4282F770AF35E854266A3B7FB88384FC40135D56D82795EF7CE545C760

Function 00007FF79967B69C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF79967B6B8
RtlCaptureContext.KERNEL32 ref: 00007FF79967B6E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF79967B6FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF79967B740
IsDebuggerPresent.KERNEL32 ref: 00007FF79967B794
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF79967B7B5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF79967B7C0

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction ID: a9708fb7a3e633e3eb38e7d45f224c5d3cb3a5af0e966f563d7cd089b86e752e
Opcode Fuzzy Hash: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction Fuzzy Hash: 4031FB76609B8186EB70AF74E8803E9A3B5FB84748F84443ADA5D47B98DF39D548C720

Function 00007FF799689AE4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF799689B5D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF799689B75
RtlVirtualUnwind.KERNEL32 ref: 00007FF799689BB0
IsDebuggerPresent.KERNEL32 ref: 00007FF799689BE9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF799689BF3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF799689BFE

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction ID: e02bac7b03dbe61250b26fd3c13de4a0cf2c8a16a0d12732deda991ae49560da
Opcode Fuzzy Hash: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction Fuzzy Hash: AE315D36618B8186EB709F35E8402AEB3B5FB89758F940136EAAD43B95DF38D145CB10

Function 00007FF7996909B4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF799690A00
FindFirstFileExW.KERNEL32 ref: 00007FF799690B0A

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 1a8060551746b007c23963201f19a9fa9ddec40a19b74045b76b4ab8f762ca91
Instruction ID: 626e5933edbde6d71bf49e8fefc7ece27d86cf5c8d2fa147fde69814f6b31543
Opcode Fuzzy Hash: 1a8060551746b007c23963201f19a9fa9ddec40a19b74045b76b4ab8f762ca91
Instruction Fuzzy Hash: F8B1A322B1869281FA70AF3694041B9E3B2EF45BE4FD45172EE6E47B89DE3CE441C350

Function 00007FF799692D30 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF799692D96
memcpy_s.LIBCPMT ref: 00007FF799692DC1

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 5f3f773494876914bf03129c0596bb6fa50943519a568eca35e43c568d0255d9
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: A0C10672B1828687EB34DF25A044A6AF7B2F784B88F848139DB5E47754DB3DE805CB50

Function 00007FF799698B68 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF799698DB7
RaiseException.KERNEL32 ref: 00007FF799698DC8

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 34bf4ba4d1f77b159a602f4f3a79dc58b46c4397abc6f90fe1b78d3c276b8e03
Instruction ID: 82a8a090ea5711e4e29ca30e29164bc71dacb41a3a5bd6524a82a6c6c91a3c3a
Opcode Fuzzy Hash: 34bf4ba4d1f77b159a602f4f3a79dc58b46c4397abc6f90fe1b78d3c276b8e03
Instruction Fuzzy Hash: 63B16B73604B898BFB25CF39C846368BBB1F784B48F598962DA6D837A4CB39D451C710

Function 00007FF799677820 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF799677851
FindClose.KERNEL32 ref: 00007FF799677860

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b154a429360a9d8fc422caeeb97d2d39407f5ca637504bf6a4efef03296319f0
Instruction ID: 529c263646e1b78c74edd339f47d51a6586a5edb5e6b3772105f477338b7700c
Opcode Fuzzy Hash: b154a429360a9d8fc422caeeb97d2d39407f5ca637504bf6a4efef03296319f0
Instruction Fuzzy Hash: B1F0A432A2878186F7709F70E4447AAB3E1BB44768F800335D67D026D4DF3CD009CA10

Function 00007FF799682C04 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF799682FB4
, xrefs: 00007FF799682D72

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 2d8c388a4af4e59f7aa018185c24a80b808f927c20487c79df8fa8b9671cd73b
Instruction ID: ead4230ac6688c94ffdd1a177ddeb08e3cb716eabde5b40b6df905de0ee097d5
Opcode Fuzzy Hash: 2d8c388a4af4e59f7aa018185c24a80b808f927c20487c79df8fa8b9671cd73b
Instruction Fuzzy Hash: 46E1B072A08646C6FB78AE37815453DE7B2FF44BC8F944235DA2E07694DF29E842C760

Function 00007FF79968D098 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF79968D222
e+000, xrefs: 00007FF79968D1A5

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: e8ad3313ac50deca76865dcff50c63e8317fb702a62c77948e89599ff08dba86
Instruction ID: 94c0c3dfe1208e277667219267643242b15584c8d2402e12e228355a0c5fa554
Opcode Fuzzy Hash: e8ad3313ac50deca76865dcff50c63e8317fb702a62c77948e89599ff08dba86
Instruction Fuzzy Hash: 8A513832B182C587F7349E369960769E7A2EB45B94F888231CBAC47AC5CE3DE4448720

Function 00007FF79968CC04 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF79968CF46

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 24567b7b7ad9cc25883cfe86a0af8cdb31fb8148e1153fa934f37376d4be2ae6
Instruction ID: d372ea775c5c2969632b78e93827bd2a83f5ae6d0f7d2ec16bff7c914683e37e
Opcode Fuzzy Hash: 24567b7b7ad9cc25883cfe86a0af8cdb31fb8148e1153fa934f37376d4be2ae6
Instruction Fuzzy Hash: 83A12462A0878586FB31DF3AA0507B9FBB2EB55BC4F848032DA6D47795DA3EE401C711

Function 00007FF799686F98 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF799686FB7

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: a95fe7b9809f20d24c45d18936c36fa2317ccb405fffb6bad0c56651588825d4
Instruction ID: e6d360607d455c6aa0931be877efd135335bd113da7159b83d6f7b31d0c6838f
Opcode Fuzzy Hash: a95fe7b9809f20d24c45d18936c36fa2317ccb405fffb6bad0c56651588825d4
Instruction Fuzzy Hash: 0151BD52B1964281FE74FF3359115BAD2BAAF85BC4FC84034DE6D47B92EE3CE4428220

Function 00007FF7996925A0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7996925A4

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 6aaf01db4fcd6d8e5e92a2165bcca8bef3bc9097c29bcaeff3790f5a52787e5b
Instruction ID: 9b26ff0cece4721bcd545226b456775ea7093aec27586a6e568f7f90665f999b
Opcode Fuzzy Hash: 6aaf01db4fcd6d8e5e92a2165bcca8bef3bc9097c29bcaeff3790f5a52787e5b
Instruction Fuzzy Hash: 3FB09264E0BA42D2FA283F356C8221863B67F48700FD80079C11C40320EF3C24AAA720

Function 00007FF799682800 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b0f885fc535c3a242e303a59ba9c626026de2633fd245c18c7096fc28f432
Instruction ID: 3ab78a7e033aabcc9b4683a510b6f5b7bfa9d65de8f954899eab68babc4916f0
Opcode Fuzzy Hash: 720b0f885fc535c3a242e303a59ba9c626026de2633fd245c18c7096fc28f432
Instruction Fuzzy Hash: B3D1D362A08642C6FB78AE3B854027DE3B2FF45B98F940235CE6D17694DF39E845C320

Function 00007FF7996780A0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b4879d951165098d7d9ad8dfdbe188c5f26750c92d05a39af3c572e9b4c9ce
Instruction ID: d299268ad21596e4e4d94126ac808d8ab2f42ee8a6bee1f4bc5b60923fbbc22b
Opcode Fuzzy Hash: 25b4879d951165098d7d9ad8dfdbe188c5f26750c92d05a39af3c572e9b4c9ce
Instruction Fuzzy Hash: E1C185721141E04BE2D9EB29E45947EB7A1F78934DBD4403BEB8747B89C63CE414D760

Function 00007FF799681E70 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3511ad376341763adbf03eaa1481790c1cd7a3e825f7d6c297581565e8b6740f
Instruction ID: 8fabc85e970854b9493aaf256d3d490c79ac6af529e0db84ea3f1f03d8dee77b
Opcode Fuzzy Hash: 3511ad376341763adbf03eaa1481790c1cd7a3e825f7d6c297581565e8b6740f
Instruction Fuzzy Hash: E1B16A72918685C5FB749F3AC05023CBBB2E749B88FA54136CB9E47795CF29E481C720

Function 00007FF79968D718 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b482d32cf4439f597672c93949c919f143e2d798b80af63496daf47fa9f459cc
Instruction ID: ea1dfe8ebaccd5197bae628e9413077fae446cbab69be6633007ad2ff5823ba9
Opcode Fuzzy Hash: b482d32cf4439f597672c93949c919f143e2d798b80af63496daf47fa9f459cc
Instruction Fuzzy Hash: 7181B372A08781C7FB74EF2AA450369E6B2FB45794F944235DBAD43B85DE3DE4408B20

Function 00007FF799695820 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 43964b9baea6600a933ee8e1a049a499104490ec7162e6d0a4f8078b6de4c171
Instruction ID: e501fcc070212416ed7724a3a474ad74db2d9395964613436981e86f7a7c2c15
Opcode Fuzzy Hash: 43964b9baea6600a933ee8e1a049a499104490ec7162e6d0a4f8078b6de4c171
Instruction Fuzzy Hash: 0761D322E1829246FB74AE398450379E6B3BF40370F94427ADE3E466D5EE7DE8048724

Function 00007FF7996813C4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
Instruction ID: c9a8dcadc433851f3c9fbeb8d41d76f4a34d725c86d73a937cc82ea45ce7d9eb
Opcode Fuzzy Hash: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
Instruction Fuzzy Hash: D7516E76A18651C6F7349F3AD040228F7B2EB49B68FA54131CE5D577A4CB3AE882C790

Function 00007FF799680BA4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
Instruction ID: bd5888f25da8d6cb1d8007187e3f798a02ab72cf9a0197b69c23eeaaa1d51ad8
Opcode Fuzzy Hash: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
Instruction Fuzzy Hash: A9519F76A18A51C6F7349F3AD0442A8F3B2EB48B68F645531CE6D077A5CB3AE842C750

Function 00007FF799680FB4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
Instruction ID: d70b5cced6f63ac5279cc6b8053c05f078c12df06cad382070a5ea1161eebd2e
Opcode Fuzzy Hash: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
Instruction Fuzzy Hash: DB518136A28651C2F7349F3AC440238E7B2EB45BA8FA54131CA9D17794CF7AE883C750

Function 00007FF7996811C0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
Instruction ID: 2aff6afee196e53e6dd0132401155c4fd441080b52e14fb5ede4fff57082d135
Opcode Fuzzy Hash: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
Instruction Fuzzy Hash: B1518C32A18A51C6F7349F3AD05062CE7B2EB49B58FA54131CE5C577A8CB2AE8C3D750

Function 00007FF7996809A0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
Instruction ID: fce44f1c78f60d73e945b854d28247ae7c19af5d13690ebfd44bfdd0fb0919f1
Opcode Fuzzy Hash: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
Instruction Fuzzy Hash: 8B51A036A18655C2F7349F3AC0402BCE7B2EB45B58FA84532CE5D177A5DB3AE842C750

Function 00007FF799680DB0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
Instruction ID: 9a28e43c7201dedb32141f1002174d6ab93af6a1122d7cba553ae11c35e248ed
Opcode Fuzzy Hash: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
Instruction Fuzzy Hash: 7751D336A18651C5F7349F3AC0442B9F3B2EB49B58FA48531DE5C17794CB3AE852C750

Function 00007FF799684F50 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 417a38378c40fc3ac0223dfbfae53db4648283139436519a9ba3f9e1c84696ed
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: E241D45381D64AC4F9B19D3A45006B8EAB2AF637E1DE853F4DCBA173C2CD0C2586C161

Function 00007FF799688BA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d52a693ca64156346f3ce50e8e1564a69fccf06189b002bdd4e7495fde204544
Instruction ID: b322df590eb5fe641848424e0b0d2ab7b105bab07963ec476499b4480a1934f5
Opcode Fuzzy Hash: d52a693ca64156346f3ce50e8e1564a69fccf06189b002bdd4e7495fde204544
Instruction Fuzzy Hash: A4410862715A5482FF64DF3AD9145A9F3B2BB48FD4B849036EE1D87B58DE3CD4428310

Function 00007FF799686560 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4673de95ce1c3203f19ce9ce644468e75f80e7845f38315ddde02822e300f2
Instruction ID: bf800fc66c3221958ea018c5c47e08cc8be30f54f9e632594479463cd873a5dc
Opcode Fuzzy Hash: ee4673de95ce1c3203f19ce9ce644468e75f80e7845f38315ddde02822e300f2
Instruction Fuzzy Hash: 0B31B332718B8282F634AF366550129EAA6AF85BA0F944238EA6D53B95DF3CD0128615

Function 00007FF7996989B0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98f8205f4dd5ad0f3b4c63852b6076f32f3a1b530b1ff8e23dc59df104b107b
Instruction ID: e23c47f5a682016f68a7eea4b8e62faa0bf6194194f658648eb26772c3cc7dcc
Opcode Fuzzy Hash: b98f8205f4dd5ad0f3b4c63852b6076f32f3a1b530b1ff8e23dc59df104b107b
Instruction Fuzzy Hash: B8F068B17182658BFBA89F79A81262977E1F7083C0F849039D59D87B04D63C90518F14

Function 00007FF79967B880 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ec394501486fefa8e68c4fc5f22486c81951ca79d36a27091b1f9b4683aa64
Instruction ID: 23a32dbfbc8e99c82b99839b2860aad61f9dcb6a52f159d3e5e6d43802c1544d
Opcode Fuzzy Hash: 03ec394501486fefa8e68c4fc5f22486c81951ca79d36a27091b1f9b4683aa64
Instruction Fuzzy Hash: EEA0023590CD06D0FA64BF30E850030A3B2FB90304BC40073D43D411A09F3CE440D320

Function 00007FF7996755D0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7996771B0: LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF7996771D3

GetProcAddress.KERNEL32 ref: 00007FF799675F67
GetProcAddress.KERNEL32 ref: 00007FF799675FA6
GetProcAddress.KERNEL32 ref: 00007FF799675FCB
GetProcAddress.KERNEL32 ref: 00007FF799675FF0
GetProcAddress.KERNEL32 ref: 00007FF799676018
GetProcAddress.KERNEL32 ref: 00007FF799676040
GetProcAddress.KERNEL32 ref: 00007FF799676068
GetProcAddress.KERNEL32 ref: 00007FF799676090
GetProcAddress.KERNEL32 ref: 00007FF7996760B8

Strings

GetProcAddress, xrefs: 00007FF799675F80
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF79967643A
Tcl_Alloc, xrefs: 00007FF7996763A6
Tcl_CreateInterp, xrefs: 00007FF799675F9C
Tcl_MutexLock, xrefs: 00007FF7996760D6
Tcl_EvalEx, xrefs: 00007FF799676356
Tcl_NewByteArrayObj, xrefs: 00007FF7996762B6
Tcl_NewStringObj, xrefs: 00007FF79967628E
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF7996762FA
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF799676052
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF7996762D2
Tcl_CreateObjCommand, xrefs: 00007FF79967623E
Failed to get address for Tcl_SetVar2, xrefs: 00007FF799676232
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF79967616A
Failed to get address for Tcl_CreateThread, xrefs: 00007FF7996760A2
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF799675FDD
Failed to get address for Tcl_Init, xrefs: 00007FF799675F79
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF79967611A
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF799676192
Tcl_SetVar2Ex, xrefs: 00007FF7996762DE
Failed to get address for Tcl_EvalEx, xrefs: 00007FF799676372
Tk_GetNumMainWindows, xrefs: 00007FF79967641E
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF79967561A
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF799676002
Tcl_ConditionWait, xrefs: 00007FF799676176
Tcl_FindExecutable, xrefs: 00007FF799675FC1
Failed to get address for Tcl_MutexLock, xrefs: 00007FF7996760F2
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF7996761BA
Tcl_FinalizeThread, xrefs: 00007FF799676036
Failed to get address for Tcl_Finalize, xrefs: 00007FF79967602A
Tcl_MutexUnlock, xrefs: 00007FF7996760FE
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF799676322
Tcl_Init, xrefs: 00007FF799675F60
Tcl_ThreadAlert, xrefs: 00007FF7996761C6
Tcl_ConditionNotify, xrefs: 00007FF79967614E
Tcl_EvalFile, xrefs: 00007FF79967632E
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF79967639A
Tcl_CreateThread, xrefs: 00007FF799676086
Tcl_GetObjResult, xrefs: 00007FF799676306
Failed to get address for Tk_Init, xrefs: 00007FF799676412
Tcl_DoOneEvent, xrefs: 00007FF799675FE6
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF799676142
Tcl_ThreadQueueEvent, xrefs: 00007FF79967619E
Tcl_GetVar2, xrefs: 00007FF7996761EE
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF7996760CA
Failed to get address for Tcl_Free, xrefs: 00007FF7996763EA
Tcl_Free, xrefs: 00007FF7996763CE
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF79967607A
Tk_Init, xrefs: 00007FF7996763F6
Tcl_GetString, xrefs: 00007FF799676266
Tcl_GetCurrentThread, xrefs: 00007FF7996760AE
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF7996761E2
Failed to get address for Tcl_EvalFile, xrefs: 00007FF79967634A
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF7996762AA
Failed to get address for Tcl_Alloc, xrefs: 00007FF7996763C2
Failed to get address for Tcl_GetVar2, xrefs: 00007FF79967620A
Failed to get address for Tcl_GetString, xrefs: 00007FF799676282
Tcl_Finalize, xrefs: 00007FF79967600E
Tcl_SetVar2, xrefs: 00007FF799676216
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF79967625A
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF799675FB8
Tcl_ConditionFinalize, xrefs: 00007FF799676126
Tcl_DeleteInterp, xrefs: 00007FF79967605E
Tcl_EvalObjv, xrefs: 00007FF79967637E

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction ID: 546daf0d824da9f2b12c76f8f05e1ef928d541f19300c744d51915337564c0f2
Opcode Fuzzy Hash: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction Fuzzy Hash: F0E1CF64A0DB0391FE75EF39A9501B4A3FBAF04794BC465B5C82E06768EF7CF5488221

Function 00007FF799672030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF79967205B
SelectObject.GDI32 ref: 00007FF7996720A2
DrawTextW.USER32 ref: 00007FF7996720C5
SelectObject.GDI32 ref: 00007FF7996720DB
ReleaseDC.USER32 ref: 00007FF7996720EB
MoveWindow.USER32 ref: 00007FF79967213B
MoveWindow.USER32 ref: 00007FF79967217B
MoveWindow.USER32 ref: 00007FF7996721CE
MoveWindow.USER32 ref: 00007FF799672216

Strings

P%, xrefs: 00007FF7996720AF

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction ID: c1987bf39f7f84d644c155ce87cb73f5a88b4865fa1a55fa3f7f935fd86d001b
Opcode Fuzzy Hash: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction Fuzzy Hash: 9451E6266147A186E634AF36A4181BAF7B2F798BA5F004121EBDE43784DF3CD045DB20

Function 00007FF799680228 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF799680268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF799680630
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7996808CF

Strings

p, xrefs: 00007FF79968030D
p, xrefs: 00007FF799680372
f, xrefs: 00007FF7996804B5
f, xrefs: 00007FF799680300
f, xrefs: 00007FF79968036A

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction ID: 81cff7df6d6c556f5b8e30e0c4cfa7491e3a93097ea40b906064c210628f2328
Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction Fuzzy Hash: 921281A2E0D143C6FB707E26E1542FAE2B3FB80750FD44835D6A9466C4DB7CE4818B61

Function 00007FF7996712B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF79967134C
malloc, xrefs: 00007FF799671353
fseek, xrefs: 00007FF799671319
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7996713E2
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF799671312
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7996712E2
fread, xrefs: 00007FF7996713E9

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 70f2d7e612742e451021b5ff7637aededee4a2924d019024c3dfd69a0212e249
Instruction ID: 62d1080928c1f2fd2ba1252469e17ace3cf6550700a41940ae2740a5f9e9959a
Opcode Fuzzy Hash: 70f2d7e612742e451021b5ff7637aededee4a2924d019024c3dfd69a0212e249
Instruction Fuzzy Hash: B0416A22A0974281FA34FF25E4056BAE3B2EB44794FD54432DE6D47B55EE3CE5828720

Function 00007FF79967DC30 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF79967DC8D

Part of subcall function 00007FF79967EBA0: __GetUnwindTryBlock.LIBCMT ref: 00007FF79967EBE3
Part of subcall function 00007FF79967EBA0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF79967EC08

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF79967DD65
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF79967DFBA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF79967E0C6

Strings

csm, xrefs: 00007FF79967DD0E
csm, xrefs: 00007FF79967DCA7
csm, xrefs: 00007FF79967DD88

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction ID: a90bb8456953b4de09257b5f234b98d66b6a506c40b77641ebbfe4cacb03056d
Opcode Fuzzy Hash: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction Fuzzy Hash: DCE16A72A08B418AFB30AF3594502ADB7B2FB55798F900535EEAD57B95CF38E094C710

Function 00007FF79968DDB8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF79968E152,?,?,000002CBEB838558,00007FF79968A223,?,?,?,00007FF79968A11A,?,?,?,00007FF799685472), ref: 00007FF79968DF34
GetProcAddress.KERNEL32(?,00000000,?,00007FF79968E152,?,?,000002CBEB838558,00007FF79968A223,?,?,?,00007FF79968A11A,?,?,?,00007FF799685472), ref: 00007FF79968DF40

Strings

api-ms-, xrefs: 00007FF79968DE7E
ext-ms-, xrefs: 00007FF79968DE91

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction ID: f260d4db76f6b8784395444d1fd7ea88a066038ecdba909e45030ec7c15cfee3
Opcode Fuzzy Hash: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction Fuzzy Hash: D441CF21B1AA1283FA36AF279824575E2A3BF15BA0FC94135DD2D47B84DE3CF445C234

Function 00007FF799677600 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79967101D), ref: 00007FF79967769F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79967101D), ref: 00007FF7996776EF

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF799677718
Failed to get UTF-8 buffer size., xrefs: 00007FF799677731
Out of memory., xrefs: 00007FF799677721
win32_utils_to_utf8, xrefs: 00007FF799677728
WideCharToMultiByte, xrefs: 00007FF799677738

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: ff563fd808d69f35f83569dbbc19b7f1e21c5d08308d418d8919d0e7ff1619ab
Instruction ID: 0d5e00988aadbea750dcf7a87416e449d809141b83344e7ad1b7caf5271dac2d
Opcode Fuzzy Hash: ff563fd808d69f35f83569dbbc19b7f1e21c5d08308d418d8919d0e7ff1619ab
Instruction Fuzzy Hash: 69416D32A18B8282E630EF25B44016AF7FAFB84B94F984135DAAD47B94EF3CD451C710

Function 00007FF799677B40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF799673699), ref: 00007FF799677B81

Part of subcall function 00007FF799672620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF799677744,?,?,?,?,?,?,?,?,?,?,?,00007FF79967101D), ref: 00007FF799672654
Part of subcall function 00007FF799672620: MessageBoxW.USER32 ref: 00007FF79967272C

WideCharToMultiByte.KERNEL32(?,00007FF799673699), ref: 00007FF799677BF5

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF799677BFF
Failed to get UTF-8 buffer size., xrefs: 00007FF799677B8E
Out of memory., xrefs: 00007FF799677BBB
win32_utils_to_utf8, xrefs: 00007FF799677BC2
WideCharToMultiByte, xrefs: 00007FF799677B95, 00007FF799677C06

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: aced5f46d53ba3e30c592e5434d0d7ab1f54160dd14b943fd141642a19c75b6b
Instruction ID: c824078db04d8ba7a6d76ae15dbc936f5b6e84e1b63cf3fb44b90d23f7e5b2ea
Opcode Fuzzy Hash: aced5f46d53ba3e30c592e5434d0d7ab1f54160dd14b943fd141642a19c75b6b
Instruction Fuzzy Hash: C7217C71A09B4285FA20EF36A840079B6B7EB88B84FD84576CA6E43794EF7DE551C310

Function 00007FF799689264 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7996892A7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF799689694
_invalid_parameter_noinfo.LIBCMT ref: 00007FF799689930

Strings

p, xrefs: 00007FF7996893D1
f, xrefs: 00007FF7996893C9
p, xrefs: 00007FF799689359

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction ID: 1f1a71ee98f36a80f6aef0a51284f36c4e885c80b5c72fdfb15640155fd405a6
Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction Fuzzy Hash: 371271A2E0C143C6FB347E76D154279F6B2EB82756FC84435E7AA466C4DA3CE5818B20

Function 00007FF799677C30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF799677CC5
MultiByteToWideChar.KERNEL32 ref: 00007FF799677D07

Strings

Failed to decode wchar_t from UTF-8, xrefs: 00007FF799677D2D
MultiByteToWideChar, xrefs: 00007FF799677D4D
Out of memory., xrefs: 00007FF799677D36
Failed to get wchar_t buffer size., xrefs: 00007FF799677D46
win32_utils_from_utf8, xrefs: 00007FF799677D3D

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: 290b57ca8453ae885af3ff2fc0035437ec55c1325ab119fe22c2f927501d8716
Instruction ID: 8f214edc4514a6805941a47f19ed538f2d8c633251cbe1df22c28f565c6bc270
Opcode Fuzzy Hash: 290b57ca8453ae885af3ff2fc0035437ec55c1325ab119fe22c2f927501d8716
Instruction Fuzzy Hash: A2416B32A18B4282F630EF35A44017AA7BAFB48B94F945135DAAD47BA4EF3CD452C710

Function 00007FF799676480 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF799677A30: MultiByteToWideChar.KERNEL32 ref: 00007FF799677A6A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7996767CF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF7996764DF

Part of subcall function 00007FF799672770: MessageBoxW.USER32 ref: 00007FF799672841

Strings

LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF79967653A
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7996764B6
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7996764F3

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: e82e75a9301f2c01be817318613aadd6cb56ce3046e43f6970fb0f78f3b425c1
Instruction ID: 266ed820efb383508b0c9beb70bef48630d694d6329b3ef92696a695b2a67dbb
Opcode Fuzzy Hash: e82e75a9301f2c01be817318613aadd6cb56ce3046e43f6970fb0f78f3b425c1
Instruction Fuzzy Hash: 19316911B1974291FA30BF31A9553BAD6B3AF987C0FC44031DA6E827DAEE2CE5048720

Function 00007FF79967CEE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF79967D19A,?,?,?,00007FF79967CE8C,?,?,00000001,00007FF79967CAA9), ref: 00007FF79967CF6D
GetLastError.KERNEL32(?,?,?,00007FF79967D19A,?,?,?,00007FF79967CE8C,?,?,00000001,00007FF79967CAA9), ref: 00007FF79967CF7B
LoadLibraryExW.KERNEL32(?,?,?,00007FF79967D19A,?,?,?,00007FF79967CE8C,?,?,00000001,00007FF79967CAA9), ref: 00007FF79967CFA5
FreeLibrary.KERNEL32(?,?,?,00007FF79967D19A,?,?,?,00007FF79967CE8C,?,?,00000001,00007FF79967CAA9), ref: 00007FF79967CFEB
GetProcAddress.KERNEL32(?,?,?,00007FF79967D19A,?,?,?,00007FF79967CE8C,?,?,00000001,00007FF79967CAA9), ref: 00007FF79967CFF7

Strings

api-ms-, xrefs: 00007FF79967CF8D

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction ID: 4c21afe2fbe12589a4483beb81a974cddd8ac0454b33f17811cba323b8c94d9c
Opcode Fuzzy Hash: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction Fuzzy Hash: 6E31B021A1AB4296FE71AF22A400575A3F6FF08BA4F994935DD3D4A390DF3CE445C720

Function 00007FF799677A30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF799677A6A

Part of subcall function 00007FF799672620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF799677744,?,?,?,?,?,?,?,?,?,?,?,00007FF79967101D), ref: 00007FF799672654
Part of subcall function 00007FF799672620: MessageBoxW.USER32 ref: 00007FF79967272C

MultiByteToWideChar.KERNEL32 ref: 00007FF799677AF0

Strings

Failed to decode wchar_t from UTF-8, xrefs: 00007FF799677AFA
MultiByteToWideChar, xrefs: 00007FF799677A7E, 00007FF799677B01
Out of memory., xrefs: 00007FF799677AB2
Failed to get wchar_t buffer size., xrefs: 00007FF799677A77
win32_utils_from_utf8, xrefs: 00007FF799677AB9

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: a067ef3949ab1c43b8cad70a8c207a907739284b21da8d2c9820fdf83144c31f
Instruction ID: 4a75324088f6c00c57e3098ae5e7121ca9c913d2835dcd07ebb7702587889bf3
Opcode Fuzzy Hash: a067ef3949ab1c43b8cad70a8c207a907739284b21da8d2c9820fdf83144c31f
Instruction Fuzzy Hash: FA213222B18A4281FA60EF35F400069E3B2EF85784F944572DB6C83B69EF2DD5418710

Function 00007FF79968A620 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F,?,?,?,00007FF799689313), ref: 00007FF79968A62F
FlsGetValue.KERNEL32(?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F,?,?,?,00007FF799689313), ref: 00007FF79968A644
FlsSetValue.KERNEL32(?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F,?,?,?,00007FF799689313), ref: 00007FF79968A665
FlsSetValue.KERNEL32(?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F,?,?,?,00007FF799689313), ref: 00007FF79968A692
FlsSetValue.KERNEL32(?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F,?,?,?,00007FF799689313), ref: 00007FF79968A6A3
FlsSetValue.KERNEL32(?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F,?,?,?,00007FF799689313), ref: 00007FF79968A6B4
SetLastError.KERNEL32(?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F,?,?,?,00007FF799689313), ref: 00007FF79968A6CF

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6fa1fab48d66e1463309dc109adf4585d75bfd82a6fbadce2d7c74c597cc3b40
Instruction ID: 73d80ed725b09cdc29989f16e4ca3e2d422295f8e366a04a994ffe3a41db0764
Opcode Fuzzy Hash: 6fa1fab48d66e1463309dc109adf4585d75bfd82a6fbadce2d7c74c597cc3b40
Instruction Fuzzy Hash: 9A213A70A0D202C2FA79BF725655139E2735F55BA0F940734D97E076DAEE2CB4414220

Function 00007FF79969706C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF79969709D
GetLastError.KERNEL32 ref: 00007FF7996970A9
CloseHandle.KERNEL32 ref: 00007FF7996970C1
CreateFileW.KERNEL32 ref: 00007FF7996970EC
WriteConsoleW.KERNEL32 ref: 00007FF79969710B

Strings

CONOUT$, xrefs: 00007FF7996970CD

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
Instruction ID: ae27a9527c60b533e4b94566da19de37db28d38fe5cb4b266f5bfbfad138cc7f
Opcode Fuzzy Hash: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
Instruction Fuzzy Hash: 2C119635B18A4186F760AF22E854325B2B6FB88FE4F840274D96D47794CF3CD404C750

Function 00007FF79968A798 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF79968444D,?,?,?,?,00007FF79968DDA7,?,?,00000000,00007FF79968A8B6,?,?,?), ref: 00007FF79968A7A7
FlsSetValue.KERNEL32(?,?,?,00007FF79968444D,?,?,?,?,00007FF79968DDA7,?,?,00000000,00007FF79968A8B6,?,?,?), ref: 00007FF79968A7DD
FlsSetValue.KERNEL32(?,?,?,00007FF79968444D,?,?,?,?,00007FF79968DDA7,?,?,00000000,00007FF79968A8B6,?,?,?), ref: 00007FF79968A80A
FlsSetValue.KERNEL32(?,?,?,00007FF79968444D,?,?,?,?,00007FF79968DDA7,?,?,00000000,00007FF79968A8B6,?,?,?), ref: 00007FF79968A81B
FlsSetValue.KERNEL32(?,?,?,00007FF79968444D,?,?,?,?,00007FF79968DDA7,?,?,00000000,00007FF79968A8B6,?,?,?), ref: 00007FF79968A82C
SetLastError.KERNEL32(?,?,?,00007FF79968444D,?,?,?,?,00007FF79968DDA7,?,?,00000000,00007FF79968A8B6,?,?,?), ref: 00007FF79968A847

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f18d8f431814927885b9c894ece884b545559122ce24857c2491552e22e71327
Instruction ID: 5df83c42c9f1df5862224c82ffc349bcf3d72941a2ea16f0cfe7e2f3e893981e
Opcode Fuzzy Hash: f18d8f431814927885b9c894ece884b545559122ce24857c2491552e22e71327
Instruction Fuzzy Hash: D8111834A0D642C2FA797F325A55179E1B35F55BB0BD44634D97E076D6EE2CA8028230

Function 00007FF79967C8A8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF79967C8D3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF79967C968
RtlUnwindEx.KERNEL32 ref: 00007FF79967C9B7

Strings

f, xrefs: 00007FF79967C8E6
csm, xrefs: 00007FF79967C94E

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
Instruction ID: ff8f632eba6582de534bbb4c5b25ca9f2b9bb5762084c20fcc012411f0c243a8
Opcode Fuzzy Hash: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
Instruction Fuzzy Hash: E451B432A0970286F774EF35D404A39B7B6FB45B88F908131DA6A47748DF3EE9418710

Function 00007FF799672240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF79967242F), ref: 00007FF799672278
DialogBoxIndirectParamW.USER32 ref: 00007FF79967233C
DeleteObject.GDI32 ref: 00007FF79967236F
DestroyIcon.USER32 ref: 00007FF799672381

Strings

Unhandled exception in script, xrefs: 00007FF7996722A8

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 01a0bb9e98a22bc39d92f1d9306349b6b95e7735addeeef39cbdf51254e5f23a
Instruction ID: 4aad9533128c2b7fd2fa26b7d8d5e179ec7ec655d1878852b9112b5b5da526f0
Opcode Fuzzy Hash: 01a0bb9e98a22bc39d92f1d9306349b6b95e7735addeeef39cbdf51254e5f23a
Instruction Fuzzy Hash: 13311826A09A8289EB24EF71E8552F9A3B2FF88794F800135EA5D4BB59DF3CD1458710

Function 00007FF799672620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF799677744,?,?,?,?,?,?,?,?,?,?,?,00007FF79967101D), ref: 00007FF799672654

Part of subcall function 00007FF7996774B0: GetLastError.KERNEL32(00000000,00007FF7996726A0), ref: 00007FF7996774D7
Part of subcall function 00007FF7996774B0: FormatMessageW.KERNEL32(00000000,00007FF7996726A0), ref: 00007FF799677506

Part of subcall function 00007FF799677A30: MultiByteToWideChar.KERNEL32 ref: 00007FF799677A6A

MessageBoxW.USER32 ref: 00007FF79967272C
MessageBoxA.USER32 ref: 00007FF799672748

Strings

%s%s: %s, xrefs: 00007FF7996726AD
Fatal error detected, xrefs: 00007FF799672700, 00007FF79967273A

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction ID: 4966ea3d39accd05bf1668c54926c908baa1c8b0c422090da719c9a7e6978903
Opcode Fuzzy Hash: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction Fuzzy Hash: 7E31217662878291F630AF20E4517EAA3B6FB84784FC04036E69D47B99DF3CD245CB50

Function 00007FF7996888E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF799688905
GetProcAddress.KERNEL32 ref: 00007FF79968891B
FreeLibrary.KERNEL32 ref: 00007FF799688942

Strings

CorExitProcess, xrefs: 00007FF799688914
mscoree.dll, xrefs: 00007FF7996888FC

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
Instruction ID: 9738b7bfc7961fb854a5b2b908624a3026d39fe20d89d17cb6810a516e3c78e5
Opcode Fuzzy Hash: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
Instruction Fuzzy Hash: 65F04965A19A0281FE30AF35A455339E372AF897A5FD40636DA7E456E4CF2CD489C320

Function 00007FF7996987A4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7996987CC
_set_statfp.LIBCMT ref: 00007FF7996987E7
_set_statfp.LIBCMT ref: 00007FF799698803
_set_statfp.LIBCMT ref: 00007FF79969883F

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: 5273b52561b0eeae0844fd26ed9061ab117a3b0aa19a504c2cb5ad8c71c2bef7
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: D411E322E1CA0711F6B43934E64137994636F593F4FC402B1E97E0A6D6CE2CAC424171

Function 00007FF79968A860 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF799689A73,?,?,00000000,00007FF799689D0E,?,?,?,?,?,00007FF7996821EC), ref: 00007FF79968A87F
FlsSetValue.KERNEL32(?,?,?,00007FF799689A73,?,?,00000000,00007FF799689D0E,?,?,?,?,?,00007FF7996821EC), ref: 00007FF79968A89E
FlsSetValue.KERNEL32(?,?,?,00007FF799689A73,?,?,00000000,00007FF799689D0E,?,?,?,?,?,00007FF7996821EC), ref: 00007FF79968A8C6
FlsSetValue.KERNEL32(?,?,?,00007FF799689A73,?,?,00000000,00007FF799689D0E,?,?,?,?,?,00007FF7996821EC), ref: 00007FF79968A8D7
FlsSetValue.KERNEL32(?,?,?,00007FF799689A73,?,?,00000000,00007FF799689D0E,?,?,?,?,?,00007FF7996821EC), ref: 00007FF79968A8E8

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b230e00eb3a4a963830e94931d1c566e9f2167cfa2cfe95f454d85ffeb99a2ab
Instruction ID: 9b6a671119ecf4fcedd45297de1a1f84c078312404fc8ff5c6481a1f2c9d242a
Opcode Fuzzy Hash: b230e00eb3a4a963830e94931d1c566e9f2167cfa2cfe95f454d85ffeb99a2ab
Instruction Fuzzy Hash: 3E114A30F0D24282FA79BF375551179D1635F557A0FD45634E87D066C6DE2CB8028630

Function 00007FF79968A6F4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F), ref: 00007FF79968A705
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F), ref: 00007FF79968A724
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F), ref: 00007FF79968A74C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F), ref: 00007FF79968A75D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F), ref: 00007FF79968A76E

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 2ba98259ac8f671f7b11ef4b4b97e12d4d2c3255f6215eff0bd660afad52eb11
Instruction ID: c600ec7857520844fcbcd2d6753b112b199179e28c033915c05c953ea5b01934
Opcode Fuzzy Hash: 2ba98259ac8f671f7b11ef4b4b97e12d4d2c3255f6215eff0bd660afad52eb11
Instruction Fuzzy Hash: 8C11D638A09202C2FA79BE73486617AD2B34F65770F981734D97E0A2D2ED2CB8419231

Function 00007FF79968F198 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79968F477

Part of subcall function 00007FF799695474: _invalid_parameter_noinfo.LIBCMT ref: 00007FF799695491

Strings

UTF-16LEUNICODE, xrefs: 00007FF79968F415
ccs, xrefs: 00007FF79968F3B2
UTF-8, xrefs: 00007FF79968F3F6

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction ID: 6a04b2884da6226e2135f1ea046e6eeccb1f56293f9bf8eeeaad9e54e848b90e
Opcode Fuzzy Hash: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction Fuzzy Hash: 2D818136E0C202C6F7B47E3F8110278F6B2AB15B88FD58035DA6997295DF2DE90197E1

Function 00007FF79967E108 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF79967E154
_CallSETranslator.LIBVCRUNTIME ref: 00007FF79967E1A3

Strings

RCC, xrefs: 00007FF79967E171
MOC, xrefs: 00007FF79967E168

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
Instruction ID: 0c7c17a54c280728cd13650006602fa1da4f6f08516bfc2eb66169e5c95b0cf1
Opcode Fuzzy Hash: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
Instruction Fuzzy Hash: DF615A32A08B458AF721EF75D4803ADB7B1FB54B88F544225EEAD17BA4DB38E049C710

Function 00007FF79967E464 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF79967E48C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF79967E574

Strings

csm, xrefs: 00007FF79967E4AE
csm, xrefs: 00007FF79967E5C6

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction ID: f4ee3320e5ad9ff6ad4ec54d7b9544e339ecb18db1cc1e515017a1ebf144bc10
Opcode Fuzzy Hash: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction Fuzzy Hash: 3D51A23290874286FB75AF359144268B7B2EB64B88F944135DAEC47BE9CF3CE454CB20

Function 00007FF7996724D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF799677A30: MultiByteToWideChar.KERNEL32 ref: 00007FF799677A6A

MessageBoxW.USER32 ref: 00007FF7996725D7
MessageBoxA.USER32 ref: 00007FF7996725F3

Strings

%s%s: %s, xrefs: 00007FF799672558
Fatal error detected, xrefs: 00007FF7996725AB, 00007FF7996725E5

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction ID: 5b8e46e8302c47d9ea066a141f81b2a46648a287224672c7f22f75f15ca7f6ef
Opcode Fuzzy Hash: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction Fuzzy Hash: 7A31007262878191F630AF21E4516EAA3B6FB84784F804136EA9D47A99DE3CD245CB50

Function 00007FF799673BA0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF799673699), ref: 00007FF799673BD1

Part of subcall function 00007FF799672620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF799677744,?,?,?,?,?,?,?,?,?,?,?,00007FF79967101D), ref: 00007FF799672654
Part of subcall function 00007FF799672620: MessageBoxW.USER32 ref: 00007FF79967272C

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF799673C0A
Failed to get executable path., xrefs: 00007FF799673BDB
GetModuleFileNameW, xrefs: 00007FF799673BE2

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction ID: dffbce791132760f5be8225a78daa5b0ea1281113cd13322f5da4ed9f6b4ff4e
Opcode Fuzzy Hash: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction Fuzzy Hash: 3F018B61B1D74281FA31BF30E8163B992B7AF587C4FC01136E96E86782EE5CE2449730

Function 00007FF79968BA70 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF79968BAEF
WriteFile.KERNEL32 ref: 00007FF79968BDB7
WriteFile.KERNEL32 ref: 00007FF79968BDFD
GetLastError.KERNEL32 ref: 00007FF79968BEB3

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction ID: cd3ab9652e57334b64d9d140007e6eed0ed1f8a5953b3dcaa2a7ada916a12d81
Opcode Fuzzy Hash: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction Fuzzy Hash: B7D1E232B18A8089F760DF76D4442ACB7B2FB447D8B844235CE6E97B99DE38D006C350

Function 00007FF799671F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF799671FA4
SetWindowLongPtrW.USER32 ref: 00007FF799671FC6
GetWindowLongPtrW.USER32 ref: 00007FF799671FF0
InvalidateRect.USER32 ref: 00007FF799672010

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction ID: bc90904309d3f667db24ee901797d85f9d580e76026818d8ac0b72da71b4ce20
Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction Fuzzy Hash: A511E921E1824242F670AF79E5442B992F3EF89BC0FC54531E96907B8DCE2CE5C58210

Function 00007FF799694D3C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7996908A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7996908D3

_get_daylight.LIBCMT ref: 00007FF799694E54
_get_daylight.LIBCMT ref: 00007FF799694E65

Strings

?, xrefs: 00007FF799694DE5

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: c6b54485bead06bc5539c244e4ab75d05ddcaebff17989ae90453d9827129cd1
Instruction ID: 6b01e440941dc5163ab57b0ecb3ed7e5a68d92ee47a57b60a1306a6ed90a2512
Opcode Fuzzy Hash: c6b54485bead06bc5539c244e4ab75d05ddcaebff17989ae90453d9827129cd1
Instruction Fuzzy Hash: 73411613B0829256FB74AF36941137AE6B2EF85BA4F944235EF6C07AD9DE3CD4418710

Function 00007FF799687E6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF799687E9E

Part of subcall function 00007FF799689E18: RtlFreeHeap.NTDLL(?,?,?,00007FF799691E42,?,?,?,00007FF799691E7F,?,?,00000000,00007FF799692345,?,?,?,00007FF799692277), ref: 00007FF799689E2E
Part of subcall function 00007FF799689E18: GetLastError.KERNEL32(?,?,?,00007FF799691E42,?,?,?,00007FF799691E7F,?,?,00000000,00007FF799692345,?,?,?,00007FF799692277), ref: 00007FF799689E38

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF79967B105), ref: 00007FF799687EBC

Strings

C:\Users\user\Desktop\datasett.exe, xrefs: 00007FF799687EAA

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\datasett.exe
API String ID: 3580290477-1493852099
Opcode ID: 3943842da798c31a181edbdfd7e827be925f8530d91395b67a93139410b16115
Instruction ID: d69124471f018cccae0e80c5d84f1b3ef7d7639a628cb99532278cae2eb1c6d6
Opcode Fuzzy Hash: 3943842da798c31a181edbdfd7e827be925f8530d91395b67a93139410b16115
Instruction Fuzzy Hash: 26413D32A08B52C5FB24EF3694800B8E7BAEF45794BD44035EA5E47B85DF3DE5518360

Function 00007FF79968C108 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF79968C21F
GetLastError.KERNEL32 ref: 00007FF79968C241

Strings

U, xrefs: 00007FF79968C1CB

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
Instruction ID: c674b034956e11e7d4147ff2ed63dd633aebf65f3fdbd16420a39800683daa9b
Opcode Fuzzy Hash: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
Instruction Fuzzy Hash: 05418232618A4186EB30EF65E4543A9F7B2FB88794F804031EA9D87798DF3DD445C750

Function 00007FF79968E508 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF79968E548
GetCurrentDirectoryW.KERNEL32 ref: 00007FF79968E59A

Strings

:, xrefs: 00007FF79968E55E

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: c96ce3ad044416fb9599911189556e1cf2cbbd82c862d3c5499b8d6e200c136e
Instruction ID: a09eeda34d77d794f760f5627ac5d5e08f744e5ed0c2a8ee637f2b01ea036148
Opcode Fuzzy Hash: c96ce3ad044416fb9599911189556e1cf2cbbd82c862d3c5499b8d6e200c136e
Instruction Fuzzy Hash: 2F21C162B0868182FB31BF26D45426DE3B3FB98B84FC54035DAAC03684DF7DE9458761

Function 00007FF799672880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF799677A30: MultiByteToWideChar.KERNEL32 ref: 00007FF799677A6A

MessageBoxW.USER32 ref: 00007FF799672951
MessageBoxA.USER32 ref: 00007FF79967296D

Strings

Error detected, xrefs: 00007FF799672925, 00007FF79967295F

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
Instruction ID: 72a35d2578bfbd66debe4400ba3a1f86263eecf90689500c1563fe9fbb1934c9
Opcode Fuzzy Hash: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
Instruction Fuzzy Hash: F621537262878191F630AF21E4517EAA375FB84788FC05136EA9D47699DF3CD205C760

Function 00007FF799672770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF799677A30: MultiByteToWideChar.KERNEL32 ref: 00007FF799677A6A

MessageBoxW.USER32 ref: 00007FF799672841
MessageBoxA.USER32 ref: 00007FF79967285D

Strings

Fatal error detected, xrefs: 00007FF799672815, 00007FF79967284F

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
Instruction ID: 370392ddde5b19fd3fd6f2c2f04d3a1aeec67d6fc58d05bf8affe2fa37159e22
Opcode Fuzzy Hash: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
Instruction Fuzzy Hash: AA21837262878191F630AF20E4517EAA375FB84788FC04136EA9D47A59DF3CD205C760

Function 00007FF79967EFB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF79967EFF4
RaiseException.KERNEL32 ref: 00007FF79967F03A

Strings

csm, xrefs: 00007FF79967F027

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
Instruction ID: b17b47fb378fbb744091bfc1783650c24abc21330beed59452ca14b197a67309
Opcode Fuzzy Hash: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
Instruction Fuzzy Hash: ED113A36618B8182FB219F25F540269B7E6FB88B98F584230EE9C07B68DF3DD555CB00

Function 00007FF79968F00C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79968F03C
GetDriveTypeW.KERNEL32 ref: 00007FF79968F07C

Strings

:, xrefs: 00007FF79968F065

Memory Dump Source

Source File: 00000000.00000002.2911881886.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000000.00000002.2911853503.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911926351.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2911963212.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2912010188.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff799670000_datasett.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
Instruction ID: dde30b3fd0988479af6cf27e77e808aa52c3a0143abc28a05ff0c63f7916f321
Opcode Fuzzy Hash: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
Instruction Fuzzy Hash: 57018F22928602CAFB31BF7594612BEE3B1EF58788FC41035E66D82691DE2CE544DA64

Analysis Process: datasett.exePID: 5756, Parent PID: 6864COMMON

Executed Functions

Function 61B04A60 Relevance: 114.9, APIs: 55, Strings: 10, Instructions: 1120COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON39 ref: 61B04B27
PyErr_Format.PYTHON39 ref: 61B04B8F
PyErr_Format.PYTHON39 ref: 61B04BF0
PyErr_Format.PYTHON39 ref: 61B04C53

Strings

{*, xrefs: 61B05B3A
OOy#|i, xrefs: 61B04D1A
<frozen %U>, xrefs: 61B04E81, 61B04ED1
hdinfo, xrefs: 61B05075
__mp_main__, xrefs: 61B052AE
__spec__, xrefs: 61B052ED
%s (%d:%d), xrefs: 61B04B20, 61B04B88, 61B04BE9, 61B04C4C, 61B04E3F, 61B04F54, 61B0585B, 61B05A5D, 61B05AF3, 61B05B48
000000, xrefs: 61B05040
__main__, xrefs: 61B05288
keyinfo, xrefs: 61B04F8A

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_Format
String ID: %s (%d:%d)$000000$<frozen %U>$OOy#|i$__main__$__mp_main__$__spec__$hdinfo$keyinfo${*
API String ID: 376477240-2716110574
Opcode ID: 9b1ab26a11ad1bb2733ac7d68b91d98a4ba956d7b6fbf290d621237b3ae3ad02
Instruction ID: 157978833c5d2ffdb28cf7d92e9e324c6d243f66cbc8371f25dfafb05c8d7ccf
Opcode Fuzzy Hash: 9b1ab26a11ad1bb2733ac7d68b91d98a4ba956d7b6fbf290d621237b3ae3ad02
Instruction Fuzzy Hash: B4A25C72205BC485EB198F66E8803993FA2FB8AF86F48D526DE9D47B64DF39C451C304

Function 61B05E70 Relevance: 114.4, APIs: 49, Strings: 16, Instructions: 658
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PySys_GetObject.PYTHON39 ref: 61B05E8E
PyTuple_GetItem.PYTHON39 ref: 61B05EA8
PyLong_AsLong.PYTHON39 ref: 61B05EBD
PyTuple_GetItem.PYTHON39 ref: 61B05ECD
PyLong_AsLong.PYTHON39 ref: 61B05EDB
PySys_GetObject.PYTHON39 ref: 61B05EEA
PyLong_AsVoidPtr.PYTHON39 ref: 61B05EF6
GetProcAddress.KERNEL32 ref: 61B05F14
GetProcAddress.KERNEL32 ref: 61B05F34
GetProcAddress.KERNEL32 ref: 61B05F54
PyModule_Create2.PYTHON39 ref: 61B05F80
PyModule_GetName.PYTHON39 ref: 61B05F95
strrchr.MSVCRT ref: 61B05FBA
malloc.MSVCRT ref: 61B05FD0
memcpy.MSVCRT ref: 61B05FEA
PyBytes_FromStringAndSize.PYTHON39 ref: 61B0603D
PyBytes_AsString.PYTHON39 ref: 61B06057
malloc.MSVCRT ref: 61B0606B
PyCMethod_New.PYTHON39 ref: 61B060B9
PyCMethod_New.PYTHON39 ref: 61B060FF
PyCMethod_New.PYTHON39 ref: 61B06145
PyBytes_FromStringAndSize.PYTHON39 ref: 61B0616F
PyBytes_AsString.PYTHON39 ref: 61B06185
_time64.MSVCRT ref: 61B06262
srand.MSVCRT ref: 61B0626A
strstr.MSVCRT ref: 61B063EC
strncmp.MSVCRT ref: 61B06422
PyErr_Format.PYTHON39 ref: 61B0648F
_Py_Dealloc.PYTHON39 ref: 61B064BB
_Py_Dealloc.PYTHON39 ref: 61B064CA
malloc.MSVCRT ref: 61B064F5
free.MSVCRT ref: 61B06564
malloc.MSVCRT ref: 61B06570
memcpy.MSVCRT ref: 61B06593
free.MSVCRT ref: 61B065BE
malloc.MSVCRT ref: 61B065CA
memcpy.MSVCRT ref: 61B065ED
_Py_Dealloc.PYTHON39 ref: 61B06614
PyErr_Format.PYTHON39 ref: 61B06899

Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1C150
Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1C172
Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1C192
Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1C1B2
Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1C1D2
Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1C1F2
Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1C212

Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1BEA3
Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1BEC3
Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1BEE5
Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1BF05
Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1BF25
Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1BF45
Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1BF65
Part of subcall function 61B1B860: memcmp.MSVCRT ref: 61B1BF85

Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1B8CB
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1B8F5
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1B914
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1B933
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1B952
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1B96D
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1B988
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1B9A3

Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BB6B
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BB8F
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BBAB
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BBCA
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BBE9
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BC04
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BC1F
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BC3A

Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BA1B
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BA45
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BA64
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BA83
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BAA2
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BABD
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BAD8
Part of subcall function 61B1B860: strcmp.MSVCRT ref: 61B1BAF3

Strings

C_ASSERT_ARMORED_INDEX, xrefs: 61B06080
pyarmor_runtime_, xrefs: 61B063E5, 61B063F6
failed to get api %s, xrefs: 61B067BA
9*, xrefs: 61B06767
version_info, xrefs: 61B05E80
aes, xrefs: 61B062CD
000000, xrefs: 61B06415
C_ENTER_CO_OBJECT_INDEX, xrefs: 61B060D7
sprng, xrefs: 61B062E7
C_LEAVE_CO_OBJECT_INDEX, xrefs: 61B0611D
PyCell_Get, xrefs: 61B05F06, 61B067AC
sha256, xrefs: 61B06301
PyCell_New, xrefs: 61B05F26, 61B067D1
dllhandle, xrefs: 61B05EDD
%s (%d:%d), xrefs: 61B06488, 61B06675, 61B066E4, 61B06775, 61B0682E, 61B06892
PyCell_Set, xrefs: 61B05F46, 61B068DA

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: strcmp$memcmp$malloc$Bytes_String$AddressDeallocLong_Method_Procmemcpy$Err_FormatFromItemLongModule_ObjectSizeSys_Tuple_free$Create2NameVoid_time64srandstrncmpstrrchrstrstr
String ID: %s (%d:%d)$000000$9*$C_ASSERT_ARMORED_INDEX$C_ENTER_CO_OBJECT_INDEX$C_LEAVE_CO_OBJECT_INDEX$PyCell_Get$PyCell_New$PyCell_Set$aes$dllhandle$failed to get api %s$pyarmor_runtime_$sha256$sprng$version_info
API String ID: 1407845306-1569967034
Opcode ID: 3256bb439fac195dcaac9ca37934e80807b31e89a84ebadc07d2a8e2871b38ed
Instruction ID: bf1f1d517f674da8726701b0166ee13e9f3f5abcebd80d3c0281abe7ed5815f9
Opcode Fuzzy Hash: 3256bb439fac195dcaac9ca37934e80807b31e89a84ebadc07d2a8e2871b38ed
Instruction Fuzzy Hash: C952B032301BC085FB18CB16E89479D3BA6FB8AB85F499526CE5D477A0DF39D192C300

Function 00007FF799695D6C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF799695AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF799695AE1
Part of subcall function 00007FF799695AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF799695B5F
Part of subcall function 00007FF799695AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF799695BB0

CreateFileW.KERNEL32 ref: 00007FF799695E72
CreateFileW.KERNEL32 ref: 00007FF799695EC2
GetLastError.KERNEL32 ref: 00007FF799695EF2
GetFileType.KERNEL32 ref: 00007FF799695F07
GetLastError.KERNEL32 ref: 00007FF799695F11
CloseHandle.KERNEL32 ref: 00007FF799695F44
CloseHandle.KERNEL32 ref: 00007FF7996960A7
CreateFileW.KERNEL32 ref: 00007FF7996960DC
GetLastError.KERNEL32 ref: 00007FF7996960EB

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction ID: 76c5159c61e54c6556610012250eb58183f845362fea9be6cddc1d9cc7974633
Opcode Fuzzy Hash: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction Fuzzy Hash: D1C1A136B28A4186FB20EF79C4906BC7772FB49BA8B811225DE2E57795CF39D055C310

Function 61B1DEF0 Relevance: 21.3, APIs: 9, Strings: 5, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 61B1DFCC
free.MSVCRT ref: 61B1E024
malloc.MSVCRT ref: 61B1E05C
free.MSVCRT ref: 61B1E0B1
free.MSVCRT ref: 61B1E0BB
memcmp.MSVCRT ref: 61B1E1AD
memcmp.MSVCRT ref: 61B1E372
memcmp.MSVCRT ref: 61B1E39B
free.MSVCRT ref: 61B1E3B0

Strings

key != NULL, xrefs: 61B1E147
hash != NULL, xrefs: 61B1E192
sig != NULL, xrefs: 61B1E179
stat != NULL, xrefs: 61B1E160
src/pk/rsa/rsa_verify_hash.c, xrefs: 61B1E140, 61B1E159, 61B1E172, 61B1E18B

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: free$memcmp$malloc
String ID: hash != NULL$key != NULL$sig != NULL$src/pk/rsa/rsa_verify_hash.c$stat != NULL
API String ID: 2896619906-237625700
Opcode ID: f62710dfa5047b8be358565e27639724d05ee2872defeb148e5b3f6399cf663b
Instruction ID: dd91e0590c2925831473277797e347cfbc76b04df85af443c2c4fe0c3dc43fca
Opcode Fuzzy Hash: f62710dfa5047b8be358565e27639724d05ee2872defeb148e5b3f6399cf663b
Instruction Fuzzy Hash: 96B1BB322086C18AEB25CF52E4457CEBBA1F7C8B88F058415DE8947B9CDBBEC549CB40

Function 00007FF7996717B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF79967185C
_fread_nolock.LIBCMT ref: 00007FF79967190E

Part of subcall function 00007FF79967F370: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79967F384

Part of subcall function 00007FF799672770: MessageBoxW.USER32 ref: 00007FF799672841

Strings

fseek, xrefs: 00007FF799671836
Failed to read cookie!, xrefs: 00007FF799671867
Could not allocate buffer for TOC!, xrefs: 00007FF7996718E3
MEI, xrefs: 00007FF7996717EF
Cannot read Table of Contents., xrefs: 00007FF799671995
malloc, xrefs: 00007FF7996718EA
Could not read full TOC!, xrefs: 00007FF799671919
fread, xrefs: 00007FF79967186E
Error on file., xrefs: 00007FF79967193D
Failed to seek to cookie position!, xrefs: 00007FF79967182F

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: d41db9dafb006d6988dc9b8f9816cab54491ab02da0be31d1dc74b9ff1bd58df
Instruction ID: 1520e5281ff2c77a7063f22a4efbb2fe4d32ca804f443b4e6700fccbcb388c44
Opcode Fuzzy Hash: d41db9dafb006d6988dc9b8f9816cab54491ab02da0be31d1dc74b9ff1bd58df
Instruction Fuzzy Hash: 89514C72A1970286FB64EF38D454178B3B2EB48B48B918136DA2D87799DF3CE541C760

Function 61B1A580 Relevance: 14.7, APIs: 4, Strings: 5, Instructions: 1167COMMON

Download Yara Rule

Strings

a != NULL, xrefs: 61B1A59B, 61B1A5DF, 61B1A62E, 61B1A66C, 61B1A719, 61B1A7C9, 61B1A838, 61B1AAA9, 61B1AAE1, 61B1AB39, 61B1ABA6, 61B1AC16, 61B1AC93, 61B1ACE6, 61B1AD5E, 61B1ADA1, 61B1AE0B, 61B1AED9, 61B1AF09, 61B1AF41, 61B1AFA5, 61B1B057, 61B1B0F0, 61B1B190, 61B1B249, 61B1B286, 61B1B2F6, 61B1B3B7, 61B1B428, 61B1B461, 61B1B4B1, 61B1B501, 61B1B551, 61B1B5A1, 61B1B5E9, 61B1B658, 61B1B6C8, 61B1B6FC, 61B1B729, 61B1B759, 61B1B78C, 61B1B804, 61B1B81D
src/math/tfm_desc.c, xrefs: 61B1A594, 61B1A5D8, 61B1A627, 61B1A665, 61B1A6C7, 61B1A6E0, 61B1A6F9, 61B1A712, 61B1A777, 61B1A790, 61B1A7A9, 61B1A7C2, 61B1A831, 61B1A84A, 61B1AA89, 61B1AAA2, 61B1AADA, 61B1AAF3, 61B1AB32, 61B1AB4B, 61B1AB64, 61B1AB9F, 61B1ABB8, 61B1ABD1, 61B1AC0F, 61B1AC28, 61B1AC41, 61B1AC8C, 61B1ACA5, 61B1ACDF, 61B1ACF8, 61B1AD11, 61B1AD57, 61B1AD9A, 61B1ADB3, 61B1AE04, 61B1AE1D, 61B1AE87, 61B1AEA0, 61B1AEB9, 61B1AED2, 61B1AF02, 61B1AF3A, 61B1AF53, 61B1AF9E, 61B1B037, 61B1B050, 61B1B0B7, 61B1B0D0, 61B1B0E9, 61B1B157, 61B1B170, 61B1B189, 61B1B1F7, 61B1B210, 61B1B229, 61B1B242, 61B1B27F, 61B1B298, 61B1B2B1, 61B1B2EF, 61B1B308, 61B1B321, 61B1B397, 61B1B3B0, 61B1B408, 61B1B421, 61B1B45A, 61B1B473, 61B1B4AA, 61B1B4C3, 61B1B4FA, 61B1B513, 61B1B54A, 61B1B563, 61B1B59A, 61B1B5B3, 61B1B5E2, 61B1B638, 61B1B651, 61B1B6A8, 61B1B6C1, 61B1B6F5, 61B1B722, 61B1B752, 61B1B785, 61B1B7FD, 61B1B816
b != NULL, xrefs: 61B1A700, 61B1A7B0, 61B1A851, 61B1AA90, 61B1AAFA, 61B1AB6B, 61B1ABD8, 61B1AC48, 61B1ACAC, 61B1AD18, 61B1ADBA, 61B1AEC0, 61B1AF5A, 61B1B03E, 61B1B0D7, 61B1B177, 61B1B230, 61B1B2B8, 61B1B328, 61B1B40F, 61B1B56A, 61B1B5BA, 61B1B63F, 61B1B6AF
d != NULL, xrefs: 61B1A6CE, 61B1A77E, 61B1AE8E, 61B1B1FE
c != NULL, xrefs: 61B1A6E7, 61B1A797, 61B1AB52, 61B1ABBF, 61B1AC2F, 61B1ACFF, 61B1AE24, 61B1AEA7, 61B1B0BE, 61B1B15E, 61B1B217, 61B1B29F, 61B1B30F, 61B1B39E, 61B1B47A, 61B1B4CA, 61B1B51A

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID:
String ID: a != NULL$b != NULL$c != NULL$d != NULL$src/math/tfm_desc.c
API String ID: 0-1480740242
Opcode ID: 1451852c553e1c08558ee9e4e3625b285a01856f0a5fe4665244bdf1d1192c45
Instruction ID: 1fe6b53d353eda252f316e30b3dd988bcd037233a97710f5bcdca1a637a25b2e
Opcode Fuzzy Hash: 1451852c553e1c08558ee9e4e3625b285a01856f0a5fe4665244bdf1d1192c45
Instruction Fuzzy Hash: 399217717165C685FE1C87B5D5823E82636FB89B88F89E015CC19433B8DB6EC2A6CF10

Function 00007FF7996712B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fseek, xrefs: 00007FF799671319
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF799671312
malloc, xrefs: 00007FF799671353
fread, xrefs: 00007FF7996713E9
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF79967134C
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7996712E2
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7996713E2

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: cb37c7c555a097e53503e66ae81f7768bf9fe455ebe18429d4774cd0b372096b
Instruction ID: 62d1080928c1f2fd2ba1252469e17ace3cf6550700a41940ae2740a5f9e9959a
Opcode Fuzzy Hash: cb37c7c555a097e53503e66ae81f7768bf9fe455ebe18429d4774cd0b372096b
Instruction Fuzzy Hash: B0416A22A0974281FA34FF25E4056BAE3B2EB44794FD54432DE6D47B55EE3CE5828720

Function 00007FF799671000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF799673BA0: GetModuleFileNameW.KERNEL32(?,00007FF799673699), ref: 00007FF799673BD1

SetDllDirectoryW.KERNEL32 ref: 00007FF7996738A5

Part of subcall function 00007FF799676990: GetEnvironmentVariableW.KERNEL32(00007FF7996736E7), ref: 00007FF7996769CA
Part of subcall function 00007FF799676990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7996769E7

Strings

Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF79967378E
Failed to convert DLL search path!, xrefs: 00007FF79967388D
MEI, xrefs: 00007FF7996737E7
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF79967382C
_PYI_ONEDIR_MODE, xrefs: 00007FF7996736FC, 00007FF799673727
_MEIPASS2, xrefs: 00007FF7996736D3, 00007FF79967373C, 00007FF7996739EB, 00007FF7996739FB

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: cd4524d5a1e723f4ec6554e8458012df770fbe15868bce12bb4c051718225b0b
Instruction ID: 17648c3f57edaf7d73939be241e71ec42d2b6b071b4714ccadf525874e1cfd54
Opcode Fuzzy Hash: cd4524d5a1e723f4ec6554e8458012df770fbe15868bce12bb4c051718225b0b
Instruction Fuzzy Hash: A4B18F21A1C78355FA70BF31A9516FDA2B2BF44784FC0013AEA6D47796EE2CE6048730

Function 00007FF799671050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF799671249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7996710B4
1.2.13, xrefs: 00007FF79967107E
malloc, xrefs: 00007FF7996710F8, 00007FF799671126
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7996710F1
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF79967111F

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: fdf4f037b0c515b4f8b70e1854daf35ae58318cf6e65c931a18ebb070cc540bc
Instruction ID: f57c4f518c918a6e20799b0583e1d9bb7b7502fd1792ec44fdb04e568c8c42f8
Opcode Fuzzy Hash: fdf4f037b0c515b4f8b70e1854daf35ae58318cf6e65c931a18ebb070cc540bc
Instruction Fuzzy Hash: A551B332A0978285FA30BF71E4403BAA2B2FB84798F954136DE6D47795EE3CE585C710

Function 00007FF79968AF2C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79968B359

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6f2067f9e2b798d7e4aa60285487f192dd8020c4dcad372bd04a148e1f9d7242
Instruction ID: 86794c04b9ad55259dcab2fc59ee1da035b8b22dfdb04dc0f5ab28f01c238609
Opcode Fuzzy Hash: 6f2067f9e2b798d7e4aa60285487f192dd8020c4dcad372bd04a148e1f9d7242
Instruction Fuzzy Hash: C1C1B232A1C686C2F671AF36A4502BDFBB2EBC5B80F990131DA6D07791DE7DE4458320

Function 00007FF79967B19C Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF79967B1AB

Part of subcall function 00007FF79967B36C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF79967B38E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF79967B1C0
__scrt_release_startup_lock.LIBCMT ref: 00007FF79967B22E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF79967B281

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction ID: ef98173b451e7d1330a28b0dce26b1527f427888adae5cffd3e70a97cbe7e631
Opcode Fuzzy Hash: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction Fuzzy Hash: 4C31F321E0D20285FA74BF75A4153B9A2B3AF91784FC94035EA3E4B3D7DE2CE8459271

Function 00007FF799684680 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7996846AD
CreateFileW.KERNEL32 ref: 00007FF7996846EC
CloseHandle.KERNEL32 ref: 00007FF799684721

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8a464286a4aee93ad09e46d96520f5fa22b2a313ca22bba1db5411dbdbef7e96
Instruction ID: f762ca71b1e01dd6d4904cb3212db958e1fba7dc521749b55fee4a5eaa0534a8
Opcode Fuzzy Hash: 8a464286a4aee93ad09e46d96520f5fa22b2a313ca22bba1db5411dbdbef7e96
Instruction Fuzzy Hash: 4D418323D1878183F764AF329510379E2B2FB997A4F509334E6AC03AD5DF6CA5E08710

Function 00007FF79967F39C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79967F3E0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79967F4D7

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bd665411d6c8cb657e02e9163d495b47fe1eb31481a6a537198dee777c004d3e
Instruction ID: 359c939177313f5bf838d56d762ae192c8cfef23f85c4250f8bf1fe814172ced
Opcode Fuzzy Hash: bd665411d6c8cb657e02e9163d495b47fe1eb31481a6a537198dee777c004d3e
Instruction Fuzzy Hash: 0C51A961B0974286FA74AE3A9400A7AE2B2BF44BB4F944735DE7D477CACF3CD4018620

Function 00007FF79968B604 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,00000000,00007FF79968B79D), ref: 00007FF79968B650
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF79968B79D), ref: 00007FF79968B65A

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction ID: 9cf9790c8b63c433ebf01f5e397d80e41410f2b3d4c9795c83f2626af0fab164
Opcode Fuzzy Hash: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction Fuzzy Hash: D81182A2618B4181EA20AF36A504169E772AB85BF4FD84331EA7D477D9DF7CD0558700

Function 00007FF799689E18 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF799691E42,?,?,?,00007FF799691E7F,?,?,00000000,00007FF799692345,?,?,?,00007FF799692277), ref: 00007FF799689E2E
GetLastError.KERNEL32(?,?,?,00007FF799691E42,?,?,?,00007FF799691E7F,?,?,00000000,00007FF799692345,?,?,?,00007FF799692277), ref: 00007FF799689E38

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 875bb2537aa3df01b4a1e34b7b101e94a2dc47b4cb64fa0c1180c15e07a79d81
Instruction ID: dbeda37524fa50c5b5854ae42925c430ec97fecaec647612b48f2ab46d76bec2
Opcode Fuzzy Hash: 875bb2537aa3df01b4a1e34b7b101e94a2dc47b4cb64fa0c1180c15e07a79d81
Instruction Fuzzy Hash: DAE08651F0D602C3FF387FB35849039D2B35F48B81BC44034CA2D46251EE2C68458230

Function 00007FF79968A028 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF799689EA5,?,?,00000000,00007FF799689F5A), ref: 00007FF79968A096
GetLastError.KERNEL32(?,?,?,00007FF799689EA5,?,?,00000000,00007FF799689F5A), ref: 00007FF79968A0A0

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction ID: 1e0f2eefaee9c4e309e563f10448470ff90ea0ba2d22df45376155c7b613c6d4
Opcode Fuzzy Hash: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction Fuzzy Hash: DC219F21B2C64281FA70BF36A454379D6B3AF847E8FC44235DA3E477D2DE6CA4458320

Function 00007FF79968B37C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79968B3A4

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
Instruction ID: 35a90b5fe2d3c6857cdd0120ef2336a50a6dda7400d0510dc451b3adbe2297be
Opcode Fuzzy Hash: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
Instruction Fuzzy Hash: A541C332918601C7FA34EE36A551279F3B2EB96B41F981131D7AE936D5CF2CE402C761

Function 00007FF799677200 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7996772AA

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: f6e1a277aeb10fb1331bcda28daf97ff4345f1edc65603338a526cfa32bf5166
Instruction ID: a557b2267482cd5e8ac648d8fb001619fb6baf0d9ce33e83678803ef10fac7ee
Opcode Fuzzy Hash: f6e1a277aeb10fb1331bcda28daf97ff4345f1edc65603338a526cfa32bf5166
Instruction Fuzzy Hash: F9218221B1979185FA31BE3269047BAE6A7BF45BD4FC84430EE2D07786CE7DE141C620

Function 00007FF79968AE0C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79968AE92

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 36b0fbc90b3b462680d3b6a13c035726274d9c74de2b43bcb58660ea55cb43b3
Instruction ID: c8791a88574331bda70ec47f18630e900064c4328027a1a39bca146c3aea5c51
Opcode Fuzzy Hash: 36b0fbc90b3b462680d3b6a13c035726274d9c74de2b43bcb58660ea55cb43b3
Instruction Fuzzy Hash: 0C319A22A18A52C1F771BF768800378E6B2AB84BA0FC10635EA3D037D2DF7CA4418731

Function 00007FF7996854C8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79968542D

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction ID: 19b1c3514b8161615b6b0f7be0a662435f2f2cc3a15f0a27e21e0f4a7c588c71
Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction Fuzzy Hash: B1114D22A1D681C1FB70BF6394006B9E2B2EF85B80FC44471EAAC57A96DF7CD4408765

Function 00007FF79969575C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79969577F

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction ID: afb4cb9c84c4b16672b249610fa4c043537a43d8cb9933a40348c3cdc68e5ab2
Opcode Fuzzy Hash: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction Fuzzy Hash: 68219232A18A4187EB71AF29E440379B6B2EB84B94F944235EB6D476D9DF3DD5008B10

Function 00007FF79967F61C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79967F670

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction ID: 1e1809824cadbbab094565f335c9ee9a554a4d9770c799cf128da6c9ccde3737
Opcode Fuzzy Hash: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction Fuzzy Hash: 07015221A0874241F924EF769A01469E6B6AB45FE4F884631DE7C57BDADE3CD4014720

Function 00007FF7996771B0 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF799677A30: MultiByteToWideChar.KERNEL32 ref: 00007FF799677A6A

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF7996771D3

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 40288dba5275ddc15ffa15a91633118c838af53669fd85fdeca40e2098281cd9
Instruction ID: 274bb6945943db6de8a36d5f5eaa58e0166e7420d03749e8f008c93fa6bc5a8d
Opcode Fuzzy Hash: 40288dba5275ddc15ffa15a91633118c838af53669fd85fdeca40e2098281cd9
Instruction Fuzzy Hash: 94E08622B2814582FA28AF77A50547AE2A2AF4CBC0B889035DE1D07755DD2DD4918A00

Function 00007FF79968DD40 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF79968A8B6,?,?,?,00007FF799689A73,?,?,00000000,00007FF799689D0E), ref: 00007FF79968DD95

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction ID: e976644be2ce1d09281c2d8874e8c7cd721e3fe9a32ddcce93ff72a11234caff
Opcode Fuzzy Hash: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction Fuzzy Hash: 0DF0FF54B59602C3FEB97E7355613B5D6B65F89B80F885570C92D962D2DD1CF4408330

Function 00007FF79968CACC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF79967FE44,?,?,?,00007FF799681356,?,?,?,?,?,00007FF799682949), ref: 00007FF79968CB0A

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction ID: 08d29385460776f724063a97913c8b6d9de385e3289545aa7d7ddcc484018619
Opcode Fuzzy Hash: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction Fuzzy Hash: 7BF05810B1D642C5FF347EB35910275D1B64F487E0F884631D93E962C2EE2DA8808230

Non-executed Functions

Function 61B09710 Relevance: 51.2, APIs: 27, Strings: 2, Instructions: 487COMMON

Download Yara Rule

APIs

PyList_Append.PYTHON39 ref: 61B09734
PyErr_Occurred.PYTHON39 ref: 61B09C34
PyErr_SetString.PYTHON39 ref: 61B0AACF

Strings

bad marshal data (index list too large), xrefs: 61B0AAC2
EOF read where object expected, xrefs: 61B0B0CF

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$AppendList_OccurredString
String ID: EOF read where object expected$bad marshal data (index list too large)
API String ID: 2605687773-1134984
Opcode ID: d20bc11967a0df7eeceb4dafc404b8bc1cdd865c79c0078c75228aff31a60ded
Instruction ID: 2d8e99c94c955a3e5ad6f9b4cca318c99481a50957bc89571da1349c892b77b5
Opcode Fuzzy Hash: d20bc11967a0df7eeceb4dafc404b8bc1cdd865c79c0078c75228aff31a60ded
Instruction Fuzzy Hash: 4F12AD7220ABD086EB69CB66E45435E7BA5FB89B86F09C919CE9D47754EF3CC404CB00

Function 00007FF799671B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF799671BDE
MulDiv.KERNEL32 ref: 00007FF799671BF2
MulDiv.KERNEL32 ref: 00007FF799671C13
SystemParametersInfoW.USER32 ref: 00007FF799671C5B
CreateFontIndirectW.GDI32 ref: 00007FF799671C6F
#380.COMCTL32 ref: 00007FF799671C93
CreateWindowExW.USER32 ref: 00007FF799671CE6
CreateWindowExW.USER32 ref: 00007FF799671D40
CreateWindowExW.USER32 ref: 00007FF799671D9D
CreateWindowExW.USER32 ref: 00007FF799671DFF
SendMessageW.USER32 ref: 00007FF799671E1F
SendMessageW.USER32 ref: 00007FF799671E39
SendMessageW.USER32 ref: 00007FF799671E58
SendMessageW.USER32 ref: 00007FF799671E77
SendMessageW.USER32 ref: 00007FF799671E95
SendMessageW.USER32 ref: 00007FF799671EB3
SendMessageW.USER32 ref: 00007FF799671ED1
SendMessageW.USER32 ref: 00007FF799671EE9
SendMessageW.USER32 ref: 00007FF799671F01
GetClientRect.USER32 ref: 00007FF799671F10

Part of subcall function 00007FF799672030: GetDC.USER32 ref: 00007FF79967205B
Part of subcall function 00007FF799672030: SelectObject.GDI32 ref: 00007FF7996720A2
Part of subcall function 00007FF799672030: DrawTextW.USER32 ref: 00007FF7996720C5
Part of subcall function 00007FF799672030: SelectObject.GDI32 ref: 00007FF7996720DB
Part of subcall function 00007FF799672030: ReleaseDC.USER32 ref: 00007FF7996720EB
Part of subcall function 00007FF799672030: MoveWindow.USER32 ref: 00007FF79967213B
Part of subcall function 00007FF799672030: MoveWindow.USER32 ref: 00007FF79967217B
Part of subcall function 00007FF799672030: MoveWindow.USER32 ref: 00007FF7996721CE

Strings

Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF799671BBD
EDIT, xrefs: 00007FF799671D4B
BUTTON, xrefs: 00007FF799671DB6
Close, xrefs: 00007FF799671DA8
STATIC, xrefs: 00007FF799671C9C, 00007FF799671CF1

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction ID: 8efebc3e1171f3e2d67e87de0389b4b7f97b33dabfed5e3396ae1e20e574dc68
Opcode Fuzzy Hash: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction Fuzzy Hash: 49A17A36208B8187E724DF21E55479AB3B1F788B94F90412AEB9D43B24CF3DE1A5CB50

Function 61B10820 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 213threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON39 ref: 61B1086B
PyErr_SetString.PYTHON39 ref: 61B108D4
_Py_Dealloc.PYTHON39 ref: 61B108ED
PyThreadState_Get.PYTHON39 ref: 61B109B0
_Py_CheckFunctionResult.PYTHON39 ref: 61B109F4
PyThreadState_Get.PYTHON39 ref: 61B10A23
_PyErr_GetTopmostException.PYTHON39 ref: 61B10A2C
_Py_Dealloc.PYTHON39 ref: 61B10A85

Strings

exceptions must derive from BaseException, xrefs: 61B10861
calling %R should have returned an instance of BaseException, not %R, xrefs: 61B10AEA
exception causes must derive from BaseException, xrefs: 61B108CA
No active exception to reraise, xrefs: 61B10AB7

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$DeallocState_StringThread$CheckExceptionFunctionResultTopmost
String ID: No active exception to reraise$calling %R should have returned an instance of BaseException, not %R$exception causes must derive from BaseException$exceptions must derive from BaseException
API String ID: 1467829791-3751834042
Opcode ID: aebefd4a7ea844a460234a8d876653139166e11ed65c1779bd90bf9bf74eac3b
Instruction ID: 7e7922426b9d7e76f363fb328cb47f23560ecff9d32d6c58889e73d61fd2f8d8
Opcode Fuzzy Hash: aebefd4a7ea844a460234a8d876653139166e11ed65c1779bd90bf9bf74eac3b
Instruction Fuzzy Hash: C181AD72709A9085FB094F6AE9563A97B62F786FD4F0D9421DF4A87728DF39C062C340

Function 61B11EB0 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 156memoryfileCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 61B11EFC
CreateFileA.KERNEL32 ref: 61B11F30
GlobalAlloc.KERNEL32 ref: 61B11F4A
DeviceIoControl.KERNEL32 ref: 61B11FC4
GlobalFree.KERNEL32 ref: 61B11FDA
_snprintf.MSVCRT ref: 61B12017
CreateFileA.KERNEL32 ref: 61B12044
GlobalAlloc.KERNEL32 ref: 61B12065
GlobalAlloc.KERNEL32 ref: 61B12074
DeviceIoControl.KERNEL32 ref: 61B120BC
GlobalFree.KERNEL32 ref: 61B120D5
GlobalFree.KERNEL32 ref: 61B120DA
CloseHandle.KERNEL32 ref: 61B120E4
GlobalFree.KERNEL32 ref: 61B12106

Part of subcall function 61B11B60: GetLastError.KERNEL32 ref: 61B11B64
Part of subcall function 61B11B60: FormatMessageA.KERNEL32 ref: 61B11B95
Part of subcall function 61B11B60: LocalFree.KERNEL32 ref: 61B11BB6

Strings

../src/platforms/windows/hdinfo.c, xrefs: 61B11FE7
/%d:, xrefs: 61B11EB6
\\.\PhysicalDrive%d, xrefs: 61B1200B
\\.\Scsi%d, xrefs: 61B11EC5
SCSIDISK, xrefs: 61B11F74
Empty serial number, xrefs: 61B11FE0

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Global$Free$Alloc$ControlCreateDeviceFile_snprintf$CloseErrorFormatHandleLastLocalMessage
String ID: ../src/platforms/windows/hdinfo.c$/%d:$Empty serial number$SCSIDISK$\\.\PhysicalDrive%d$\\.\Scsi%d
API String ID: 1119308327-3953537554
Opcode ID: 9816c2723dc3a8214be3b09bf30df43bc1ed0df298bfd870376ac801cd2761ab
Instruction ID: cb82978e4087179368a5e8d8e7d1879d4b0de90882f7ee9a7848302fd451922a
Opcode Fuzzy Hash: 9816c2723dc3a8214be3b09bf30df43bc1ed0df298bfd870376ac801cd2761ab
Instruction Fuzzy Hash: 1751133130468586E714DB62F81478B3B66F78ABE8F584225AF5A47BD8CF3DC556C304

Function 61B13000 Relevance: 38.6, APIs: 19, Strings: 3, Instructions: 149networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 61B1305F
gethostbyname.WS2_32 ref: 61B13070
socket.WS2_32 ref: 61B1309D
setsockopt.WS2_32 ref: 61B130D5
setsockopt.WS2_32 ref: 61B130F8
htons.WS2_32 ref: 61B1311B
sendto.WS2_32 ref: 61B13199
recvfrom.WS2_32 ref: 61B131DE
ntohl.WS2_32 ref: 61B131FF
ntohl.WS2_32 ref: 61B13209
closesocket.WS2_32 ref: 61B1322E
WSACleanup.WS2_32 ref: 61B13234
WSAGetLastError.WS2_32 ref: 61B13240
closesocket.WS2_32 ref: 61B1324B
WSACleanup.WS2_32 ref: 61B13251
SetLastError.KERNEL32 ref: 61B13260
WSAGetLastError.WS2_32 ref: 61B13280
WSACleanup.WS2_32 ref: 61B13288
SetLastError.KERNEL32 ref: 61B13297

Strings

and,, xrefs: 61B13007
http://, xrefs: 61B13005
or,, xrefs: 61B13002

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: ErrorLast$Cleanup$closesocketntohlsetsockopt$Startupgethostbynamehtonsrecvfromsendtosocket
String ID: and,$http://$or,
API String ID: 1750001962-2642771825
Opcode ID: e681eac9eee50f18a619eeb7615204cfab5a51c810bb91e8385e42ee89cfb7d2
Instruction ID: 6ae9db57c80ceb6f0f608a69dc14f6f4709141a617c7acf7f8311a24d7a45105
Opcode Fuzzy Hash: e681eac9eee50f18a619eeb7615204cfab5a51c810bb91e8385e42ee89cfb7d2
Instruction Fuzzy Hash: 9A51803120978086E7149B65F81439ABBA1F789BB4F184329EBA847BE8DF7DC455CB40

Function 61B06BA0 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 366COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 61B06C10
PyErr_Format.PYTHON39 ref: 61B06E35
PyErr_Format.PYTHON39 ref: 61B06F0D
PyErr_Format.PYTHON39 ref: 61B06FDD

Strings

%s (%d:%d), xrefs: 61B06D4C, 61B06E2B, 61B06E93, 61B06F03, 61B06FD3, 61B0703F, 61B070DF, 61B07197

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_Format$malloc
String ID: %s (%d:%d)
API String ID: 1817594650-1595188566
Opcode ID: 4402b5b3f3da27668814f07db669554e403f3b2f8977d6c90200be4ce10281a3
Instruction ID: d7ead3f36fc20aab2bd9600cdaf0289c3de5cbbe44b71f73df05e49420d5a9a2
Opcode Fuzzy Hash: 4402b5b3f3da27668814f07db669554e403f3b2f8977d6c90200be4ce10281a3
Instruction Fuzzy Hash: 13E18E713057C091FF2D8B6AD4903A96F61FB8AB8AF48D516CE9E4B751DF2AC191C300

Function 61B12260 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 171fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 61B12285
wsprintfA.USER32 ref: 61B12297
CreateFileA.KERNEL32 ref: 61B122C4
memset.MSVCRT ref: 61B12303
DeviceIoControl.KERNEL32 ref: 61B12339
CloseHandle.KERNEL32 ref: 61B12346
isxdigit.MSVCRT ref: 61B123C3
isxdigit.MSVCRT ref: 61B123F0
isprint.MSVCRT ref: 61B1241B
memcpy.MSVCRT ref: 61B124AB
CloseHandle.KERNEL32 ref: 61B124B3

Strings

/%d:, xrefs: 61B12266
\\.\PhysicalDrive%d, xrefs: 61B12290

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: CloseHandleisxdigitmemset$ControlCreateDeviceFileisprintmemcpywsprintf
String ID: /%d:$\\.\PhysicalDrive%d
API String ID: 2355516209-72258043
Opcode ID: 539e0980b89c655e506ea7fcab5d8ac614b65f2fb97a52885634a194a2c3adcd
Instruction ID: ba70bdf5610265abe11b235b78ad599b6f4773da65ded49ab53bb079925f3ecc
Opcode Fuzzy Hash: 539e0980b89c655e506ea7fcab5d8ac614b65f2fb97a52885634a194a2c3adcd
Instruction Fuzzy Hash: C951E47220C6C085E714CB36A88175B7BA2FBC3798F188255EEA547B9CDB7DC149C740

Function 61B21CC0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 110encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 61B21D16
CryptAcquireContextA.ADVAPI32 ref: 61B21D36
CryptGenRandom.ADVAPI32 ref: 61B21D47
CryptReleaseContext.ADVAPI32 ref: 61B21D5D
clock.MSVCRT ref: 61B21DA0
clock.MSVCRT ref: 61B21DB3
clock.MSVCRT ref: 61B21DBC
clock.MSVCRT ref: 61B21DD3

Strings

out != NULL, xrefs: 61B21E27
src/prngs/rng_get_bytes.c, xrefs: 61B21E20
Microsoft Base Cryptographic Provider v1.0, xrefs: 61B21D05, 61B21D2C
(, xrefs: 61B21D1E

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Cryptclock$Context$Acquire$RandomRelease
String ID: ($Microsoft Base Cryptographic Provider v1.0$out != NULL$src/prngs/rng_get_bytes.c
API String ID: 2525729555-3762154145
Opcode ID: 664029c3a03ce603981a67e03d759ef43b739e561f25fe8be545134a9185594b
Instruction ID: bd5aa807cc7c4628d4cb9857e61ba6e15ff8c2353238977866f1f35c1fa32f3f
Opcode Fuzzy Hash: 664029c3a03ce603981a67e03d759ef43b739e561f25fe8be545134a9185594b
Instruction Fuzzy Hash: 4A31C772218AD0C5E714EB66E8403AA7AB5F789BD4F49D425DE4943724DF7BC446C340

Function 00007FFDFAFC266C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 168COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFB18DE61
GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFB18DE82
GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFB18DE9D
GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFB18DEB8
GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFB18DF00
WideCharToMultiByte.KERNEL32 ref: 00007FFDFB18DF36
WideCharToMultiByte.KERNEL32 ref: 00007FFDFB18DF8B

Strings

RANDFILE, xrefs: 00007FFDFB18DE49
HOME, xrefs: 00007FFDFB18DE70
USERPROFILE, xrefs: 00007FFDFB18DE8E
.rnd, xrefs: 00007FFDFB18E03A
SYSTEMROOT, xrefs: 00007FFDFB18DEA9

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: EnvironmentVariable$ByteCharMultiWide
String ID: .rnd$HOME$RANDFILE$SYSTEMROOT$USERPROFILE
API String ID: 2184640988-1666712896
Opcode ID: 45285921c275070c670ca49d0546862358ccffd5776fb92ec22702d428bfbd5c
Instruction ID: 91c2f4458b1c1c3a6839b0615171552380e9327c2856552766003b095141979c
Opcode Fuzzy Hash: 45285921c275070c670ca49d0546862358ccffd5776fb92ec22702d428bfbd5c
Instruction Fuzzy Hash: 6761B723B09B8346EB149F25946057A6791FF49BA8B588235EE7D47BE8DF3DE005C300

Function 00007FFDFAEA12C0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 343COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFAEA1890: PyMem_Malloc.PYTHON39 ref: 00007FFDFAEA18FB

PyMem_Malloc.PYTHON39 ref: 00007FFDFAEA1342
PyMem_Free.PYTHON39 ref: 00007FFDFAEA1486
PyErr_NoMemory.PYTHON39 ref: 00007FFDFAEA3EE9
_Py_Dealloc.PYTHON39 ref: 00007FFDFAEA3EF9

Strings

0, xrefs: 00007FFDFAEA1316

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Mem_$Malloc$DeallocErr_FreeMemory
String ID: 0
API String ID: 1635361834-4108050209
Opcode ID: 5a26e20e75cb925fbbc9c56ae8020c188d100fa82e418ab62db65b67776e16e2
Instruction ID: 10bd35d72d627182c72fa4ec231027eb51e7f43d885e906e628c85110efff340
Opcode Fuzzy Hash: 5a26e20e75cb925fbbc9c56ae8020c188d100fa82e418ab62db65b67776e16e2
Instruction Fuzzy Hash: F5E1D3B6B0C65385EB68AB15D428E7937A5FF64740F1445B1EA6F8A6C8DF3EE840C700

Function 00007FFDFAFC5A1F Relevance: 13.6, APIs: 9, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFB205EDC
memset.VCRUNTIME140 ref: 00007FFDFB205F00
RtlCaptureContext.KERNEL32 ref: 00007FFDFB205F09
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFB205F23
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFB205F64
memset.VCRUNTIME140 ref: 00007FFDFB205F97
IsDebuggerPresent.KERNEL32 ref: 00007FFDFB205FB8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB205FD9
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB205FE4

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 544d81e5d0bf66c33f804bb133da19342079062bac93336a06aa1597cb30c435
Instruction ID: 5338f69ffefef489a6b6b4a7b4e43727de15a13118c08adc1d7f70f53074fcfd
Opcode Fuzzy Hash: 544d81e5d0bf66c33f804bb133da19342079062bac93336a06aa1597cb30c435
Instruction Fuzzy Hash: 6C312372706B8296EB649F60E8507ED7364FB44748F484439DA9E47AE8DF3CD548C710

Function 00007FFDFAEA3310 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFAEA332C
memset.VCRUNTIME140 ref: 00007FFDFAEA3350
RtlCaptureContext.KERNEL32 ref: 00007FFDFAEA3359
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFAEA3373
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFAEA33B4
memset.VCRUNTIME140 ref: 00007FFDFAEA33E7
IsDebuggerPresent.KERNEL32 ref: 00007FFDFAEA3408
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFAEA3429
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFAEA3434

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: d9e6df729bf43983b28923cb177ae3541e73e5dfa40f51ce2d15500382af1989
Instruction ID: c8117b95ed82edbdcb4ed2cbea8f68031bd3056991d0446675c805ae0eaac316
Opcode Fuzzy Hash: d9e6df729bf43983b28923cb177ae3541e73e5dfa40f51ce2d15500382af1989
Instruction Fuzzy Hash: AD316FB6709B8286EB649F60E8A07ED7360FB55744F444039DA5E4BBD8DF39D548C700

Function 61B7D400 Relevance: 12.0, APIs: 8, Instructions: 50COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 61B7D414
RtlLookupFunctionEntry.KERNEL32 ref: 61B7D42B
RtlVirtualUnwind.KERNEL32 ref: 61B7D46D
SetUnhandledExceptionFilter.KERNEL32 ref: 61B7D4B1
UnhandledExceptionFilter.KERNEL32 ref: 61B7D4BE
GetCurrentProcess.KERNEL32 ref: 61B7D4C4
TerminateProcess.KERNEL32 ref: 61B7D4D2
abort.MSVCRT ref: 61B7D4D8

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
String ID:
API String ID: 4278921479-0
Opcode ID: 565b4dba366b93dfe5723ea80be56f87d20ac07c4d9203be2a11d40ce13b90f1
Instruction ID: 24a07919d90983fe8eb262763da414d11cd95f28c468d95535ec3116b44cb4b4
Opcode Fuzzy Hash: 565b4dba366b93dfe5723ea80be56f87d20ac07c4d9203be2a11d40ce13b90f1
Instruction Fuzzy Hash: B321F375210F0495EB049B65F8807D937A6FB0AB94F58A92AEA4E47724EF3AC166C340

Function 00007FFDFAEA1890 Relevance: 10.9, APIs: 7, Instructions: 428COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON39 ref: 00007FFDFAEA18FB
PyUnicode_FromKindAndData.PYTHON39 ref: 00007FFDFAEA1ADD
PyMem_Free.PYTHON39 ref: 00007FFDFAEA1AE9
PyMem_Realloc.PYTHON39 ref: 00007FFDFAEA1BCD
PyMem_Free.PYTHON39 ref: 00007FFDFAEA4061
PyErr_NoMemory.PYTHON39 ref: 00007FFDFAEA4067

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Mem_$Free$DataErr_FromKindMallocMemoryReallocUnicode_
String ID:
API String ID: 857045822-0
Opcode ID: 132545a872591c33b0f38a43d07c0a6304a613e13b36cdfa53bc8be909f7a12d
Instruction ID: c2c58760ea3cfd6aba32f4ea12ce2344857b22361370697a44b1283fcde494c2
Opcode Fuzzy Hash: 132545a872591c33b0f38a43d07c0a6304a613e13b36cdfa53bc8be909f7a12d
Instruction Fuzzy Hash: A80203B2B0865282EB6CAB14D474EB966A1EF95740F1441B1DAAF4E7C8DE3FE844D300

Function 00007FF79967B69C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF79967B6B8
RtlCaptureContext.KERNEL32 ref: 00007FF79967B6E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF79967B6FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF79967B740
IsDebuggerPresent.KERNEL32 ref: 00007FF79967B794
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF79967B7B5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF79967B7C0

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction ID: a9708fb7a3e633e3eb38e7d45f224c5d3cb3a5af0e966f563d7cd089b86e752e
Opcode Fuzzy Hash: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction Fuzzy Hash: 4031FB76609B8186EB70AF74E8803E9A3B5FB84748F84443ADA5D47B98DF39D548C720

Function 00007FF799694E20 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF799694E65

Part of subcall function 00007FF7996947B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7996947CC

Part of subcall function 00007FF799689E18: RtlFreeHeap.NTDLL(?,?,?,00007FF799691E42,?,?,?,00007FF799691E7F,?,?,00000000,00007FF799692345,?,?,?,00007FF799692277), ref: 00007FF799689E2E
Part of subcall function 00007FF799689E18: GetLastError.KERNEL32(?,?,?,00007FF799691E42,?,?,?,00007FF799691E7F,?,?,00000000,00007FF799692345,?,?,?,00007FF799692277), ref: 00007FF799689E38

Part of subcall function 00007FF799689DD0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF799689DAF,?,?,?,?,?,00007FF7996821EC), ref: 00007FF799689DD9
Part of subcall function 00007FF799689DD0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF799689DAF,?,?,?,?,?,00007FF7996821EC), ref: 00007FF799689DFE

_get_daylight.LIBCMT ref: 00007FF799694E54

Part of subcall function 00007FF799694818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79969482C

_get_daylight.LIBCMT ref: 00007FF7996950CA
_get_daylight.LIBCMT ref: 00007FF7996950DB
_get_daylight.LIBCMT ref: 00007FF7996950EC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF79969532C), ref: 00007FF799695113

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: a9f1dad40c5644c1829df854b35cf2cff202b4769108a1d535aac39d904cb9be
Instruction ID: d0c64f92b03ce063efc61caa5fbfd9126005503111557e4eeace3bce4477d8ee
Opcode Fuzzy Hash: a9f1dad40c5644c1829df854b35cf2cff202b4769108a1d535aac39d904cb9be
Instruction Fuzzy Hash: 78D1AD26A1825286FB34BF36D4501B9A7B3FF89794FC44136EA2D47785EE3CE4418760

Function 00007FF799689AE4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF799689B5D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF799689B75
RtlVirtualUnwind.KERNEL32 ref: 00007FF799689BB0
IsDebuggerPresent.KERNEL32 ref: 00007FF799689BE9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF799689BF3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF799689BFE

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction ID: e02bac7b03dbe61250b26fd3c13de4a0cf2c8a16a0d12732deda991ae49560da
Opcode Fuzzy Hash: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction Fuzzy Hash: AE315D36618B8186EB709F35E8402AEB3B5FB89758F940136EAAD43B95DF38D145CB10

Function 00007FF7996909B4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF799690A00
FindFirstFileExW.KERNEL32 ref: 00007FF799690B0A

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 0bdd7a8416f1e28eb8c09c6b5c037a8b7871395a979be626bc7410ef92a9cb5d
Instruction ID: 626e5933edbde6d71bf49e8fefc7ece27d86cf5c8d2fa147fde69814f6b31543
Opcode Fuzzy Hash: 0bdd7a8416f1e28eb8c09c6b5c037a8b7871395a979be626bc7410ef92a9cb5d
Instruction Fuzzy Hash: F8B1A322B1869281FA70AF3694041B9E3B2EF45BE4FD45172EE6E47B89DE3CE441C350

Function 00007FFDFAFC22E8 Relevance: 6.4, APIs: 5, Instructions: 140COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFDFB16398B
memset.VCRUNTIME140 ref: 00007FFDFB1639A2
memmove.VCRUNTIME140 ref: 00007FFDFB1639C9
memset.VCRUNTIME140 ref: 00007FFDFB1639D6
memmove.VCRUNTIME140 ref: 00007FFDFB163A0A

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: memmove$memset
String ID:
API String ID: 3790616698-0
Opcode ID: 5c27fcc7b015d44772e24548af3a7e83aa402ed56b7fba7a99915febce0b760f
Instruction ID: 6b8d44b3ad11ffa7f2c77faf73f3b022d9ef014df27b0c1debe8595577eb4363
Opcode Fuzzy Hash: 5c27fcc7b015d44772e24548af3a7e83aa402ed56b7fba7a99915febce0b760f
Instruction Fuzzy Hash: 6551B133B1A7868ADB10CB16E45066EABA5FB49BD4F444135EEAD477E9CE3CE501C700

Function 00007FFDFAFC2B5D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FFDFB08A629
WSAGetLastError.WS2_32 ref: 00007FFDFB08A638

Strings

..\s\crypto\bio\b_sock2.c, xrefs: 00007FFDFB08A5DE, 00007FFDFB08A64E, 00007FFDFB08A66A

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: ErrorLastbind
String ID: ..\s\crypto\bio\b_sock2.c
API String ID: 2328862993-3200932406
Opcode ID: 8475ffe534be1b52f8a83a963f2585e8110bc00f71c71f802b4263a764d0a002
Instruction ID: 82aa73f83b8cb085d51381c6eb4c6714968a8d3660196c507c34695118a57588
Opcode Fuzzy Hash: 8475ffe534be1b52f8a83a963f2585e8110bc00f71c71f802b4263a764d0a002
Instruction Fuzzy Hash: DB219F31F0954286E710DB26E814AAD6360FB85B98F414231EA7C47BEDDF3CE6558B00

Function 61B01CC0 Relevance: 2.5, Strings: 2, Instructions: 24COMMON

Download Yara Rule

Strings

ntdll.dll, xrefs: 61B01CC4
NtSetInformationThread, xrefs: 61B01CDE

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID:
String ID: NtSetInformationThread$ntdll.dll
API String ID: 0-3743287242
Opcode ID: 274c879afbb5b6e5a5d495ebab3918bc64e79a8a5d3795ddb7a66c415120be98
Instruction ID: 06f2ab34a2e6b676a108ac505a51ada70cf988f46cc73f37c5afbf63a685ecde
Opcode Fuzzy Hash: 274c879afbb5b6e5a5d495ebab3918bc64e79a8a5d3795ddb7a66c415120be98
Instruction Fuzzy Hash: FDF01C39314A4885EBA4EB45FC503853BA5F39DB98F481225EA9C83B74DF6DC262CB00

Function 61B9F1F8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d872c72239e51e91a853d1f2c6d10a77eedfd4674f578da79534aaa2f153f9
Instruction ID: 5e7f2f1cef42c61c1dd0cf8b006f4354d8196b341844097bbd9eae6740158c0f
Opcode Fuzzy Hash: e7d872c72239e51e91a853d1f2c6d10a77eedfd4674f578da79534aaa2f153f9
Instruction Fuzzy Hash: D4C08CAB9ADBE00DD32AC9E08C1E0183F09D293910728846FAB2007690E70424128281

Function 00007FFDFAFC32F6 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c56cf6a6487dceeb00cd67b5ea337eb2185dad23aeb4fdd049dd72e8a09a134
Instruction ID: a2435efe32b3cf1ef9499514209df7f51bac7e86e00274acf1a9541d7d4d9411
Opcode Fuzzy Hash: 7c56cf6a6487dceeb00cd67b5ea337eb2185dad23aeb4fdd049dd72e8a09a134
Instruction Fuzzy Hash: 52A002F8B15556296F6403615251B7406431A493C6CE29470A47A115984B1CB550A550

Function 00007FF799673DF0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673E06
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673E45
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673E6A
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673E8F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673EB7
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673EDF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673F07
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673F2F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF799673F57

Strings

PyEval_EvalCode, xrefs: 00007FF7996744F5
Failed to get address for Py_SetPythonHome, xrefs: 00007FF799674101
PyObject_SetAttrString, xrefs: 00007FF79967438D
Py_UnbufferedStdioFlag, xrefs: 00007FF799673F4D
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF799674381
Failed to get address for PyErr_Print, xrefs: 00007FF7996741A1
PyErr_Print, xrefs: 00007FF799674185
Failed to get address for PySys_GetObject, xrefs: 00007FF799674499
Failed to get address for PyList_Append, xrefs: 00007FF7996742B9
Failed to get address for PyImport_ImportModule, xrefs: 00007FF799674291
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF799674421
Failed to get address for PyUnicode_Replace, xrefs: 00007FF7996746A1
PySys_SetArgvEx, xrefs: 00007FF799674455
Failed to get address for Py_IncRef, xrefs: 00007FF799674039
Py_SetProgramName, xrefs: 00007FF7996740BD
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF799673EC9
PySys_SetPath, xrefs: 00007FF7996744CD
Py_Initialize, xrefs: 00007FF799674045
Failed to get address for Py_UTF8Mode, xrefs: 00007FF799673F99
Py_OptimizeFlag, xrefs: 00007FF799673EFD
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF799674449
PyUnicode_Replace, xrefs: 00007FF799674685
Failed to get address for Py_FrozenFlag, xrefs: 00007FF799673E7C
Py_SetPath, xrefs: 00007FF79967406D
Py_DecodeLocale, xrefs: 00007FF79967456D
PyObject_Str, xrefs: 00007FF7996743DD
Failed to get address for Py_GetPath, xrefs: 00007FF7996740B1
PyErr_Fetch, xrefs: 00007FF7996741AD
PySys_GetObject, xrefs: 00007FF79967447D
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF799673EF1
Failed to get address for Py_BuildValue, xrefs: 00007FF799673FC1
Py_NoUserSiteDirectory, xrefs: 00007FF799673ED5
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF799673F19
PyObject_CallFunction, xrefs: 00007FF79967433D
PySys_SetObject, xrefs: 00007FF7996744A5
Py_FrozenFlag, xrefs: 00007FF799673E60
Py_Finalize, xrefs: 00007FF799673FF5
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF799674269
PySys_AddWarnOption, xrefs: 00007FF79967442D
Failed to get address for PyImport_AddModule, xrefs: 00007FF799674241
PyUnicode_AsUTF8, xrefs: 00007FF799674635
Failed to get address for PyErr_Clear, xrefs: 00007FF799674151
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF799673E57
PyModule_GetDict, xrefs: 00007FF799674315
Failed to get address for Py_DecRef, xrefs: 00007FF799673FE9
Py_FileSystemDefaultEncoding, xrefs: 00007FF799673E3B
Py_SetPythonHome, xrefs: 00007FF7996740E5
PyErr_NormalizeException, xrefs: 00007FF7996741FD
PyList_New, xrefs: 00007FF7996742C5
Failed to get address for PyErr_Occurred, xrefs: 00007FF799674179
PyErr_Restore, xrefs: 00007FF7996741D5
Py_UTF8Mode, xrefs: 00007FF799673F7D
PyDict_GetItemString, xrefs: 00007FF79967410D
Py_DecRef, xrefs: 00007FF799673FCD
Failed to get address for Py_DecodeLocale, xrefs: 00007FF799674589
Failed to get address for PyEval_EvalCode, xrefs: 00007FF799674511
Failed to get address for PyUnicode_FromString, xrefs: 00007FF799674561
Failed to get address for Py_Finalize, xrefs: 00007FF799674011
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF799673EA1
PyErr_Occurred, xrefs: 00007FF79967415D
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7996743D1
PyUnicode_FromFormat, xrefs: 00007FF7996745BD
Failed to get address for PySys_SetPath, xrefs: 00007FF7996744E9
Py_GetPath, xrefs: 00007FF799674095
Failed to get address for Py_SetProgramName, xrefs: 00007FF7996740D9
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF799674219
Failed to get address for PyLong_AsLong, xrefs: 00007FF799674309
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF799674539
Failed to get address for Py_SetPath, xrefs: 00007FF799674089
Failed to get address for PyMem_RawFree, xrefs: 00007FF7996745B1
Py_DontWriteBytecodeFlag, xrefs: 00007FF799673DFF
Failed to get address for PyList_New, xrefs: 00007FF7996742E1
Failed to get address for PyDict_GetItemString, xrefs: 00007FF799674129
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF799673E18
PyUnicode_FromString, xrefs: 00007FF799674545
PyMem_RawFree, xrefs: 00007FF799674595
Py_BuildValue, xrefs: 00007FF799673FA5
PyErr_Clear, xrefs: 00007FF799674135
PyImport_ImportModule, xrefs: 00007FF799674275
Failed to get address for PyErr_Restore, xrefs: 00007FF7996741F1
PyRun_SimpleStringFlags, xrefs: 00007FF799674405
Failed to get address for PyErr_Fetch, xrefs: 00007FF7996741C9
PyObject_GetAttrString, xrefs: 00007FF7996743B5
Failed to get address for Py_Initialize, xrefs: 00007FF799674061
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF799674471
PyImport_AddModule, xrefs: 00007FF799674225
PyList_Append, xrefs: 00007FF79967429D
Failed to get address for PyUnicode_Join, xrefs: 00007FF799674679
GetProcAddress, xrefs: 00007FF799673E1F
Failed to get address for PyObject_CallFunction, xrefs: 00007FF799674359
Failed to get address for PySys_SetObject, xrefs: 00007FF7996744C1
PyUnicode_Join, xrefs: 00007FF79967465D
PyObject_CallFunctionObjArgs, xrefs: 00007FF799674365
PyUnicode_DecodeFSDefault, xrefs: 00007FF79967460D
PyMarshal_ReadObjectFromString, xrefs: 00007FF79967451D
Failed to get address for PyUnicode_Decode, xrefs: 00007FF799674601
Failed to get address for PyObject_Str, xrefs: 00007FF7996743F9
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF799674651
PyUnicode_Decode, xrefs: 00007FF7996745E5
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF799674629
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF799673F69
Failed to get address for Py_VerboseFlag, xrefs: 00007FF799673F41
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF7996745D9
PyLong_AsLong, xrefs: 00007FF7996742ED
Failed to get address for PyModule_GetDict, xrefs: 00007FF799674331
Py_VerboseFlag, xrefs: 00007FF799673F25
Py_NoSiteFlag, xrefs: 00007FF799673EAD
PyImport_ExecCodeModule, xrefs: 00007FF79967424D
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7996743A9
Py_IgnoreEnvironmentFlag, xrefs: 00007FF799673E85
Py_IncRef, xrefs: 00007FF79967401D

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction ID: af28a62bc28cbfff440a094cc9098a9a928246895e0df10b99074c1d16a3e3b6
Opcode Fuzzy Hash: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction Fuzzy Hash: 40426F64A0EB0791FA75FF34B854174A2B3AF88794BC85176C92E06364EF7CF6589220

Function 00007FF7996755D0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7996771B0: LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7996730BE), ref: 00007FF7996771D3

GetProcAddress.KERNEL32 ref: 00007FF799675F67
GetProcAddress.KERNEL32 ref: 00007FF799675FA6
GetProcAddress.KERNEL32 ref: 00007FF799675FCB
GetProcAddress.KERNEL32 ref: 00007FF799675FF0
GetProcAddress.KERNEL32 ref: 00007FF799676018
GetProcAddress.KERNEL32 ref: 00007FF799676040
GetProcAddress.KERNEL32 ref: 00007FF799676068
GetProcAddress.KERNEL32 ref: 00007FF799676090
GetProcAddress.KERNEL32 ref: 00007FF7996760B8

Strings

Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF79967611A
Failed to get address for Tcl_EvalEx, xrefs: 00007FF799676372
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF799676002
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF799675FB8
Tcl_CreateInterp, xrefs: 00007FF799675F9C
Tcl_CreateObjCommand, xrefs: 00007FF79967623E
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF7996762AA
Failed to get address for Tcl_Init, xrefs: 00007FF799675F79
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF799675FDD
Failed to get address for Tcl_CreateThread, xrefs: 00007FF7996760A2
Tcl_ThreadAlert, xrefs: 00007FF7996761C6
Tcl_CreateThread, xrefs: 00007FF799676086
Failed to get address for Tcl_GetString, xrefs: 00007FF799676282
Tcl_GetCurrentThread, xrefs: 00007FF7996760AE
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF7996762D2
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF79967639A
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF79967561A
Tcl_ConditionNotify, xrefs: 00007FF79967614E
Tcl_ThreadQueueEvent, xrefs: 00007FF79967619E
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF799676322
Tcl_NewStringObj, xrefs: 00007FF79967628E
Failed to get address for Tcl_Free, xrefs: 00007FF7996763EA
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF799676192
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF7996761E2
Tcl_ConditionWait, xrefs: 00007FF799676176
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF7996762FA
Tcl_Init, xrefs: 00007FF799675F60
Tcl_GetObjResult, xrefs: 00007FF799676306
Tcl_EvalEx, xrefs: 00007FF799676356
Tcl_NewByteArrayObj, xrefs: 00007FF7996762B6
Tcl_FindExecutable, xrefs: 00007FF799675FC1
Failed to get address for Tcl_MutexLock, xrefs: 00007FF7996760F2
Failed to get address for Tcl_Finalize, xrefs: 00007FF79967602A
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF79967616A
Tk_Init, xrefs: 00007FF7996763F6
GetProcAddress, xrefs: 00007FF799675F80
Failed to get address for Tcl_EvalFile, xrefs: 00007FF79967634A
Tcl_MutexUnlock, xrefs: 00007FF7996760FE
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF79967607A
Tcl_DeleteInterp, xrefs: 00007FF79967605E
Tcl_Alloc, xrefs: 00007FF7996763A6
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF79967643A
Tcl_MutexLock, xrefs: 00007FF7996760D6
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF7996761BA
Tcl_GetString, xrefs: 00007FF799676266
Failed to get address for Tcl_Alloc, xrefs: 00007FF7996763C2
Failed to get address for Tcl_SetVar2, xrefs: 00007FF799676232
Tcl_SetVar2, xrefs: 00007FF799676216
Tcl_FinalizeThread, xrefs: 00007FF799676036
Tcl_ConditionFinalize, xrefs: 00007FF799676126
Failed to get address for Tcl_GetVar2, xrefs: 00007FF79967620A
Failed to get address for Tk_Init, xrefs: 00007FF799676412
Tcl_GetVar2, xrefs: 00007FF7996761EE
Tcl_Free, xrefs: 00007FF7996763CE
Tcl_EvalFile, xrefs: 00007FF79967632E
Tk_GetNumMainWindows, xrefs: 00007FF79967641E
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF799676052
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF7996760CA
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF79967625A
Tcl_DoOneEvent, xrefs: 00007FF799675FE6
Tcl_EvalObjv, xrefs: 00007FF79967637E
Tcl_Finalize, xrefs: 00007FF79967600E
Tcl_SetVar2Ex, xrefs: 00007FF7996762DE
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF799676142

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction ID: 546daf0d824da9f2b12c76f8f05e1ef928d541f19300c744d51915337564c0f2
Opcode Fuzzy Hash: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction Fuzzy Hash: F0E1CF64A0DB0391FE75EF39A9501B4A3FBAF04794BC465B5C82E06768EF7CF5488221

Function 61B12870 Relevance: 75.7, APIs: 27, Strings: 16, Instructions: 436filestringCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61B128AE

Part of subcall function 61B12530: strlen.MSVCRT ref: 61B12553

fprintf.MSVCRT ref: 61B128E7
fputc.MSVCRT ref: 61B12919

Part of subcall function 61B11BD0: GetProcessHeap.KERNEL32 ref: 61B11BF3
Part of subcall function 61B11BD0: HeapAlloc.KERNEL32 ref: 61B11C07
Part of subcall function 61B11BD0: GetAdaptersAddresses.IPHLPAPI ref: 61B11C2C
Part of subcall function 61B11BD0: GetProcessHeap.KERNEL32 ref: 61B11C9F
Part of subcall function 61B11BD0: HeapFree.KERNEL32 ref: 61B11CA9

fprintf.MSVCRT ref: 61B12948

Part of subcall function 61B119E0: GetProcessHeap.KERNEL32 ref: 61B11A01
Part of subcall function 61B119E0: HeapAlloc.KERNEL32 ref: 61B11A16
Part of subcall function 61B119E0: memcpy.MSVCRT ref: 61B11A8C
Part of subcall function 61B119E0: GetProcessHeap.KERNEL32 ref: 61B11AAA
Part of subcall function 61B119E0: HeapFree.KERNEL32 ref: 61B11AB5

fputc.MSVCRT ref: 61B1297B

Part of subcall function 61B11D60: GetProcessHeap.KERNEL32 ref: 61B11D83
Part of subcall function 61B11D60: HeapAlloc.KERNEL32 ref: 61B11D97
Part of subcall function 61B11D60: GetAdaptersAddresses.IPHLPAPI ref: 61B11DBF
Part of subcall function 61B11D60: inet_ntoa.WS2_32 ref: 61B11DF7
Part of subcall function 61B11D60: GetProcessHeap.KERNEL32 ref: 61B11E12
Part of subcall function 61B11D60: HeapFree.KERNEL32 ref: 61B11E1C

fprintf.MSVCRT ref: 61B129AA
fputc.MSVCRT ref: 61B129BE

Part of subcall function 61B12160: GetProcessHeap.KERNEL32 ref: 61B1217B
Part of subcall function 61B12160: HeapAlloc.KERNEL32 ref: 61B1218F
Part of subcall function 61B12160: GetNetworkParams.IPHLPAPI ref: 61B121C7
Part of subcall function 61B12160: GetProcessHeap.KERNEL32 ref: 61B121E9
Part of subcall function 61B12160: HeapFree.KERNEL32 ref: 61B121F3

fprintf.MSVCRT ref: 61B129ED
fwrite.MSVCRT ref: 61B12A0E
strchr.MSVCRT ref: 61B12A3B
fwrite.MSVCRT ref: 61B12A73
fprintf.MSVCRT ref: 61B12A9B
strchr.MSVCRT ref: 61B12AA8
fprintf.MSVCRT ref: 61B12AC9
fputc.MSVCRT ref: 61B12AE2
fwrite.MSVCRT ref: 61B12B03
malloc.MSVCRT ref: 61B12B0D
fwrite.MSVCRT ref: 61B12EA7
fwrite.MSVCRT ref: 61B12EC8
fwrite.MSVCRT ref: 61B12EE9
fwrite.MSVCRT ref: 61B12F0A

Strings

Hardware informations got by PyArmor:, xrefs: 61B12896
Ip address: "%s", xrefs: 61B1299D
"%s", xrefs: 61B12A7D, 61B12ABC
Multiple Mac addresses: "<, xrefs: 61B12AEE
Failed to get domain name., xrefs: 61B12EF5
%02x, xrefs: 61B12E1D
%02x:, xrefs: 61B12DBE
>", xrefs: 61B12E67
Failed to get harddisk information., xrefs: 61B12E92
Failed to get mac address., xrefs: 61B12EB3
Serial number of default harddisk: "%s", xrefs: 61B128DA
Serial number with disk name: , xrefs: 61B12A5E
Domain name: "%s", xrefs: 61B129E0
Default Mac address: "%s", xrefs: 61B1293B
Change logsv6.2.0(r21): Remove trailing dot from harddisk serial numberv6.4.2(r34): Support binding multiple mac addressesv6.5.3(r37): Support binding named harddiskv6.7.5(r45): Support mmc/sd card in Linux, xrefs: 61B129F9
Failed to get ip address., xrefs: 61B12ED4

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Heap$Processfwrite$fprintf$AllocFreefputc$AdaptersAddressesstrchr$NetworkParamsinet_ntoamallocmemcpystrlen
String ID: "%s"$Change logsv6.2.0(r21): Remove trailing dot from harddisk serial numberv6.4.2(r34): Support binding multiple mac addressesv6.5.3(r37): Support binding named harddiskv6.7.5(r45): Support mmc/sd card in Linux$%02x$%02x:$>"$Default Mac address: "%s"$Domain name: "%s"$Failed to get domain name.$Failed to get harddisk information.$Failed to get ip address.$Failed to get mac address.$Hardware informations got by PyArmor:$Ip address: "%s"$Multiple Mac addresses: "<$Serial number of default harddisk: "%s"$Serial number with disk name:
API String ID: 944541899-3771683696
Opcode ID: db3219e09e0fb247a25b2312391c9d39536882a8effaa6d4aee8210fa096ef22
Instruction ID: 16528eb5665e835c1e272dd38225583e0f381d17a9191df4012963ce391d6b93
Opcode Fuzzy Hash: db3219e09e0fb247a25b2312391c9d39536882a8effaa6d4aee8210fa096ef22
Instruction Fuzzy Hash: 4D02DD32209BC086EB68DB66E44139E77A6FB8ABD4F558225DFAD47798DF39C040C701

Function 61B132E0 Relevance: 72.1, APIs: 35, Strings: 6, Instructions: 355networkstringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 61B13302
WSAStartup.WS2_32 ref: 61B13314
gethostbyname.WS2_32 ref: 61B13359
socket.WS2_32 ref: 61B13396
htons.WS2_32 ref: 61B133BD
ioctlsocket.WS2_32 ref: 61B133F2
connect.WS2_32 ref: 61B1340A
ioctlsocket.WS2_32 ref: 61B1342C
send.WS2_32 ref: 61B13464
WSAGetLastError.WS2_32 ref: 61B1346D
closesocket.WS2_32 ref: 61B13478
WSACleanup.WS2_32 ref: 61B1347E
SetLastError.KERNEL32 ref: 61B13486
recv.WS2_32 ref: 61B134DC
closesocket.WS2_32 ref: 61B134F4
WSACleanup.WS2_32 ref: 61B134FA
strstr.MSVCRT ref: 61B1350A
strstr.MSVCRT ref: 61B13535
toupper.MSVCRT ref: 61B1354A
toupper.MSVCRT ref: 61B13559
toupper.MSVCRT ref: 61B13568
toupper.MSVCRT ref: 61B13577
strstr.MSVCRT ref: 61B135D8
memcmp.MSVCRT ref: 61B1368F
memcmp.MSVCRT ref: 61B136AD
_mktime64.MSVCRT ref: 61B13754
gethostbyname.WS2_32 ref: 61B1378E
WSAGetLastError.WS2_32 ref: 61B137A7
ioctlsocket.WS2_32 ref: 61B137C4
WSAGetLastError.WS2_32 ref: 61B137C6
WSAGetLastError.WS2_32 ref: 61B137D0
WSACleanup.WS2_32 ref: 61B137D8
SetLastError.KERNEL32 ref: 61B137E0
select.WS2_32 ref: 61B1385A
ioctlsocket.WS2_32 ref: 61B13876

Strings

Dec, xrefs: 61B1369D
HEAD /%s HTTP/1.1Host: %sUser-Agent: PYARMOR.COREConnection: close, xrefs: 61B13337, 61B1376F
Nov, xrefs: 61B1367F
and,, xrefs: 61B132EB
http://, xrefs: 61B132E9
or,, xrefs: 61B132E6

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: ErrorLast$ioctlsockettoupper$Cleanupstrstr$closesocketgethostbynamememcmp$Startup_mktime64connecthtonsrecvselectsendsocketstrchr
String ID: Dec$HEAD /%s HTTP/1.1Host: %sUser-Agent: PYARMOR.COREConnection: close$Nov$and,$http://$or,
API String ID: 3493847099-1714119496
Opcode ID: 02a2d7674616e2e3c99b27f16794fa242914ab50ceb356c8588bd29c13e0bf8a
Instruction ID: 6180fe058d06a2827bb4e6e94531d92f00b8983930c33ff7c46746aaa89a51ba
Opcode Fuzzy Hash: 02a2d7674616e2e3c99b27f16794fa242914ab50ceb356c8588bd29c13e0bf8a
Instruction Fuzzy Hash: 01E1D27160CAC185EB19CB60E44179E7BB1E386BA8F09C625DA66477ACFB3DC14AC710

Function 61B07730 Relevance: 51.0, APIs: 24, Strings: 5, Instructions: 201COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON39 ref: 61B07751
PyTuple_New.PYTHON39 ref: 61B0775D
_PyObject_LookupAttr.PYTHON39 ref: 61B077BF
_PyObject_GetAttrId.PYTHON39 ref: 61B077D3
PyModule_GetFilenameObject.PYTHON39 ref: 61B077FF
PyUnicode_FromString.PYTHON39 ref: 61B0780F
_PyErr_Clear.PYTHON39 ref: 61B07849
PyErr_SetImportError.PYTHON39 ref: 61B0786F
_Py_Dealloc.PYTHON39 ref: 61B0788E

Strings

cannot import name %R from partially initialized module %R (most likely due to a circular import) (%S), xrefs: 61B079B5
%U.%U, xrefs: 61B078E2
<unknown module name>, xrefs: 61B07808
cannot import name %R from %R (%S), xrefs: 61B0799A
cannot import name %R from %R (unknown location), xrefs: 61B07855

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: AttrErr_Object_Tuple_$ClearDeallocErrorFilenameFromImportLookupModule_ObjectSizeStringUnicode_
String ID: %U.%U$<unknown module name>$cannot import name %R from %R (%S)$cannot import name %R from %R (unknown location)$cannot import name %R from partially initialized module %R (most likely due to a circular import) (%S)
API String ID: 597108667-3215622635
Opcode ID: ffd7c26c6b0ae444cfa18068a56d9014dcbae0be2f1b633e3c3726c5e6a93334
Instruction ID: 356cd707825f7eb42aa7b84d236fa47ab784eb7e76fa9f41decbe8a0917b117b
Opcode Fuzzy Hash: ffd7c26c6b0ae444cfa18068a56d9014dcbae0be2f1b633e3c3726c5e6a93334
Instruction Fuzzy Hash: FF718232606BD495EA099F57E804799BBA5FB86FD2F0C9429EE8E07720EF79C155C300

Function 61B09490 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 252COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON39 ref: 61B094A1
_PyLong_New.PYTHON39 ref: 61B094F6
PyErr_Occurred.PYTHON39 ref: 61B0956F
PyErr_Occurred.PYTHON39 ref: 61B0963A
PyErr_SetString.PYTHON39 ref: 61B0967A
PyErr_Occurred.PYTHON39 ref: 61B09A10
_PyLong_New.PYTHON39 ref: 61B0A07B
PyErr_SetString.PYTHON39 ref: 61B0A986

Strings

bad marshal data (long size out of range), xrefs: 61B0A97C
bad marshal data (digit out of range in long), xrefs: 61B09670
bad marshal data (unnormalized long data), xrefs: 61B0AA1D

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$Occurred$Long_String
String ID: bad marshal data (digit out of range in long)$bad marshal data (long size out of range)$bad marshal data (unnormalized long data)
API String ID: 3688822742-2912230410
Opcode ID: 4753700ab105c2e4f8a8c425425dff79cb1dad85ed50970d6ec298854e3f58cc
Instruction ID: 0a5ad268dbdf0cd53df9086e822cb3fe0e13803f0fdef34ef2eba7cd7c07ffc8
Opcode Fuzzy Hash: 4753700ab105c2e4f8a8c425425dff79cb1dad85ed50970d6ec298854e3f58cc
Instruction Fuzzy Hash: 97A1BB3220ABD086EA18CF26D49435E3BA6F7C5B81F19D515CE8E87758EF38E415CB40

Function 61B0DC60 Relevance: 35.5, APIs: 19, Strings: 1, Instructions: 472fileCOMMON

Download Yara Rule

APIs

_Py_hashtable_new_full.PYTHON39 ref: 61B0DCE7
_Py_hashtable_destroy.PYTHON39 ref: 61B0DD24
fwrite.MSVCRT ref: 61B0DD41
PyErr_NoMemory.PYTHON39 ref: 61B0DE12
fwrite.MSVCRT ref: 61B0E46A

Strings

too many objects, xrefs: 61B0E1E7

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: fwrite$Err_MemoryPy_hashtable_destroyPy_hashtable_new_full
String ID: too many objects
API String ID: 3535940709-4209268247
Opcode ID: 92916da1ff7b32f274e81a4dc619cf206555a269b71aecaab789aec45e3c5b74
Instruction ID: 7e16ca73a3778854a17c1ab29e9229b07010bd001c8e59bdf008c59a433d5aa1
Opcode Fuzzy Hash: 92916da1ff7b32f274e81a4dc619cf206555a269b71aecaab789aec45e3c5b74
Instruction Fuzzy Hash: 45128072209BC486DB08CB9AF44079EBFA1F785B90F648116EB9D07BA8DB7DD451CB40

Function 61B11080 Relevance: 35.3, APIs: 16, Strings: 4, Instructions: 254COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON39 ref: 61B111CB
_Py_Dealloc.PYTHON39 ref: 61B11211
PyTuple_New.PYTHON39 ref: 61B11316
PyDict_GetItem.PYTHON39 ref: 61B113FF
PyDict_DelItem.PYTHON39 ref: 61B11427
PyErr_SetString.PYTHON39 ref: 61B11454

Strings

too many positional arguments, xrefs: 61B114B4
Can't remove argname from kwargs, xrefs: 61B112A6
missing kwonly required arguments, xrefs: 61B1144A
missing required positional arguments, xrefs: 61B111C1

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Dict_Err_ItemString$DeallocTuple_
String ID: Can't remove argname from kwargs$missing kwonly required arguments$missing required positional arguments$too many positional arguments
API String ID: 2174600326-1903473336
Opcode ID: ec49b5482d368c8df5106ca1955a01da7c5b597917cd68458c5779a6ffccc9d7
Instruction ID: a5f1f5bc57a8b6a08c19be9286aa1b6f849c29fb3157f51796564943c16fee19
Opcode Fuzzy Hash: ec49b5482d368c8df5106ca1955a01da7c5b597917cd68458c5779a6ffccc9d7
Instruction Fuzzy Hash: 45B17872209BC4C1EA298F66E84539A7775F796BA4F1E8621CE9D43B6CCF39C056C700

Function 61B0FC70 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 180COMMON

Download Yara Rule

APIs

PyObject_GetIter.PYTHON39 ref: 61B0FCB7
PyIter_Next.PYTHON39 ref: 61B0FD08
PyErr_Occurred.PYTHON39 ref: 61B0FD10
_Py_Dealloc.PYTHON39 ref: 61B0FD4A
_Py_Dealloc.PYTHON39 ref: 61B0FD5B
Py_DecRef.PYTHON39 ref: 61B0FD64
Py_DecRef.PYTHON39 ref: 61B0FDAD
PyIter_Next.PYTHON39 ref: 61B0FDC8
PyErr_Format.PYTHON39 ref: 61B0FDEE
PyErr_ExceptionMatches.PYTHON39 ref: 61B0FE4A
PySequence_Check.PYTHON39 ref: 61B0FE6E
PyErr_Format.PYTHON39 ref: 61B0FE8F

Strings

too many values to unpack (expected %d), xrefs: 61B0FDE4
cannot unpack non-iterable %.200s object, xrefs: 61B0FE81
not enough values to unpack (expected %d, got %d), xrefs: 61B0FEAD

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$DeallocFormatIter_Next$CheckExceptionIterMatchesObject_OccurredSequence_
String ID: cannot unpack non-iterable %.200s object$not enough values to unpack (expected %d, got %d)$too many values to unpack (expected %d)
API String ID: 2492064420-2953850414
Opcode ID: baf18a86a4b99e095e6810f2b6d77c250043e313fc5d7c669c49d815f71091bf
Instruction ID: ef744e29b9a7218c4de91f067dca6eaddeefe549604e6cad2ece6bd0f5304abc
Opcode Fuzzy Hash: baf18a86a4b99e095e6810f2b6d77c250043e313fc5d7c669c49d815f71091bf
Instruction Fuzzy Hash: C361D332705A84C2EA199F6AE8443592B71F78AF96F0CDA1ACF2D07724DF39C096C304

Function 61B09753 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172threadCOMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON39 ref: 61B09764
PyThreadState_Get.PYTHON39 ref: 61B09F23
_Py_CheckFunctionResult.PYTHON39 ref: 61B09F6E

Strings

bad marshal data (index list too large), xrefs: 61B0ABB7
bad marshal data (set size out of range), xrefs: 61B0A6B4
NULL object in marshal data for set, xrefs: 61B0AB62

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: CheckErr_FunctionOccurredResultState_Thread
String ID: NULL object in marshal data for set$bad marshal data (index list too large)$bad marshal data (set size out of range)
API String ID: 3239669425-600355161
Opcode ID: f8fe88504f486383cece80157f09810dfb8ae224ec1cc20761054d90b08bcfbe
Instruction ID: 9963891ee206362b072890b75f8feec9bb60d742fad6c1885389d28dc6d72daf
Opcode Fuzzy Hash: f8fe88504f486383cece80157f09810dfb8ae224ec1cc20761054d90b08bcfbe
Instruction Fuzzy Hash: 6B71A032205BD081EA6CCB66E49435E3BA6F786B92F08DE25CE5E437A4DF79C445CB40

Function 61B0D410 Relevance: 32.0, APIs: 17, Strings: 1, Instructions: 473fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61B0D695
PyErr_SetString.PYTHON39 ref: 61B0D928
fwrite.MSVCRT ref: 61B0DB50

Strings

too many objects, xrefs: 61B0D91E

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: fwrite$Err_String
String ID: too many objects
API String ID: 4210527972-4209268247
Opcode ID: 83116498ad8f340bf45f9a9299a0df317b399b65d5ae10a86c4b0f04fc9a711f
Instruction ID: bb56bdfd509abbdd596c34c5efd41b3c0570625e0aaea404d1add80f7bd455fc
Opcode Fuzzy Hash: 83116498ad8f340bf45f9a9299a0df317b399b65d5ae10a86c4b0f04fc9a711f
Instruction Fuzzy Hash: 17129EB2601B8486EB18CFA9E04078D7BB5F749FE8F548216DE6D17798DB39C592C380

Function 00007FFDFAFC1B77 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 204stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB17334A
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB17338A
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1733AE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1733C7
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1733E3
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1733FC

Strings

,, xrefs: 00007FFDFB17348A
Proc-Type:, xrefs: 00007FFDFB173343
, xrefs: 00007FFDFB1733F2
..\s\crypto\pem\pem_lib.c, xrefs: 00007FFDFB173364, 00007FFDFB173417, 00007FFDFB173459, 00007FFDFB1734CE, 00007FFDFB173516, 00007FFDFB173544, 00007FFDFB1735F9
ENCRYPTED, xrefs: 00007FFDFB1733BA
DEK-Info:, xrefs: 00007FFDFB173437
, xrefs: 00007FFDFB1733D9

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: strspn$strncmp
String ID: $ $ ,$..\s\crypto\pem\pem_lib.c$DEK-Info:$ENCRYPTED$Proc-Type:
API String ID: 1384302209-3505811795
Opcode ID: 7985cfdb996600f2f998fb0a24256cf60aa534b4d69326ebc210f6f3ee5533b5
Instruction ID: 78d6d2a2913fdfde2bbab257a27ba9d972bf783b9f900427e6ce2c272021c1a4
Opcode Fuzzy Hash: 7985cfdb996600f2f998fb0a24256cf60aa534b4d69326ebc210f6f3ee5533b5
Instruction Fuzzy Hash: 2691F162F0E64392F7248B12B424A793790EF15788F644034DAAD876E9EF3CE64AC744

Function 61B07CA0 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

_PyFloat_Unpack8.PYTHON39 ref: 61B07CD1
PyBuffer_FillInfo.PYTHON39 ref: 61B07D26
PyMemoryView_FromBuffer.PYTHON39 ref: 61B07D34
_PyObject_CallMethodId_SizeT.PYTHON39 ref: 61B07D54
PyNumber_AsSsize_t.PYTHON39 ref: 61B07D73
PyErr_SetString.PYTHON39 ref: 61B07EA1

Strings

read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61B07E75
marshal data too short, xrefs: 61B07E97
EOF read where not expected, xrefs: 61B07E02

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: BufferBuffer_CallErr_FillFloat_FromInfoMemoryMethodNumber_Object_SizeSsize_tStringUnpack8View_
String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 3670709071-4172231876
Opcode ID: d019913f847f30c8bebc26232874b0bcaac65057597a46339c6c8c21ec22e92a
Instruction ID: 4a0d8fb1c443eb6e95440cb5a16b19eb135dd627b585dbdf6798abc8f50d1190
Opcode Fuzzy Hash: d019913f847f30c8bebc26232874b0bcaac65057597a46339c6c8c21ec22e92a
Instruction Fuzzy Hash: 4851A272305A80C1FB488F6AE8447986B76F746FA6F089B15CAAD077E4DF79C496C340

Function 61B07ED0 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

PyBuffer_FillInfo.PYTHON39 ref: 61B07F56
PyMemoryView_FromBuffer.PYTHON39 ref: 61B07F64
_PyObject_CallMethodId_SizeT.PYTHON39 ref: 61B07F84
PyNumber_AsSsize_t.PYTHON39 ref: 61B07FA3
PyErr_SetString.PYTHON39 ref: 61B080D1

Strings

read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61B080A5
marshal data too short, xrefs: 61B080C7
EOF read where not expected, xrefs: 61B08032

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: BufferBuffer_CallErr_FillFromInfoMemoryMethodNumber_Object_SizeSsize_tStringView_
String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 3120701247-4172231876
Opcode ID: a60dcc3c046527dd03de6037672a6fa17c5b757ae78aedfb4145044aacaebb37
Instruction ID: 3cc6df1538f21b2c13066cb3c83a0349c8e19e1894826a9acb6c546913db5d8b
Opcode Fuzzy Hash: a60dcc3c046527dd03de6037672a6fa17c5b757ae78aedfb4145044aacaebb37
Instruction Fuzzy Hash: E441A331306A80C1FE089B6AE84434C6761F74AFB9F189B29DA6D477E4EF79C556C340

Function 61B08230 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

PyBuffer_FillInfo.PYTHON39 ref: 61B082B2
PyMemoryView_FromBuffer.PYTHON39 ref: 61B082C0
_PyObject_CallMethodId_SizeT.PYTHON39 ref: 61B082E0
PyNumber_AsSsize_t.PYTHON39 ref: 61B08302
PyErr_Occurred.PYTHON39 ref: 61B0831B
PyErr_Format.PYTHON39 ref: 61B0834A
PyErr_SetString.PYTHON39 ref: 61B083F3

Strings

read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61B08340
marshal data too short, xrefs: 61B083E7
EOF read where not expected, xrefs: 61B083C7

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$BufferBuffer_CallFillFormatFromInfoMemoryMethodNumber_Object_OccurredSizeSsize_tStringView_
String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 2192429850-4172231876
Opcode ID: 4bc3ebe6c7d35183ed2ff0aab1a0106db32bc5efa6b2dc0e640cd9d66d2fe57e
Instruction ID: ee01b9dc640172dbf9036b9c22abdfbf67300644675eb42aa9a61e734353d830
Opcode Fuzzy Hash: 4bc3ebe6c7d35183ed2ff0aab1a0106db32bc5efa6b2dc0e640cd9d66d2fe57e
Instruction Fuzzy Hash: FF418E31706E80C9EA188F5AE8403992761F786FA6F4C9B259E6E077E0DF39C165D340

Function 61B0FF30 Relevance: 27.2, APIs: 18, Instructions: 153COMMON

Download Yara Rule

APIs

PyObject_Call.PYTHON39 ref: 61B0FFE2
PyErr_CheckSignals.PYTHON39 ref: 61B10017
_Py_Dealloc.PYTHON39 ref: 61B10035
_Py_Dealloc.PYTHON39 ref: 61B10043
_Py_Dealloc.PYTHON39 ref: 61B10053

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Dealloc$CallCheckErr_Object_Signals
String ID:
API String ID: 356930793-0
Opcode ID: 72c4125c384d3d52217b503d4376bed16f16bb1ff6bd0e946b1d934026054d55
Instruction ID: 47d40cf6ed5b1726683d778760eb8760c154053f5d136bda524cb8957fbe39bc
Opcode Fuzzy Hash: 72c4125c384d3d52217b503d4376bed16f16bb1ff6bd0e946b1d934026054d55
Instruction Fuzzy Hash: 3351843274BA94C6EA0DAFA7994836C6B61FB47F92F0CC52DEF0546714DF29C0668384

Function 61B11BD0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 61B11BF3
HeapAlloc.KERNEL32 ref: 61B11C07
GetAdaptersAddresses.IPHLPAPI ref: 61B11C2C
GetProcessHeap.KERNEL32 ref: 61B11C9F
HeapFree.KERNEL32 ref: 61B11CA9
GetProcessHeap.KERNEL32 ref: 61B11CC0
HeapFree.KERNEL32 ref: 61B11CCA
GetProcessHeap.KERNEL32 ref: 61B11CD1
HeapAlloc.KERNEL32 ref: 61B11CDB
GetAdaptersAddresses.IPHLPAPI ref: 61B11CF7

Strings

../src/platforms/windows/hdinfo.c, xrefs: 61B11D27
%02x:%02x:%02x:%02x:%02x:%02x, xrefs: 61B11C69
Too small size, xrefs: 61B11D20

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Heap$Process$AdaptersAddressesAllocFree
String ID: %02x:%02x:%02x:%02x:%02x:%02x$../src/platforms/windows/hdinfo.c$Too small size
API String ID: 1283795797-3992030336
Opcode ID: 363ac3b8add64117ca320a51acacd3df2f0fb84ba235e3ad47efa01060ec2998
Instruction ID: 9a2538b4e3e5ae48bea6550d60e323e13510b6ceff0000d1fadcc199f04e46e0
Opcode Fuzzy Hash: 363ac3b8add64117ca320a51acacd3df2f0fb84ba235e3ad47efa01060ec2998
Instruction Fuzzy Hash: E9313D213091D146DB29DBBA7C017AE7BA2E78ABD4F0D8226BD58C7798EB3CC0018710

Function 00007FFDFAFC4E3F Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 205registryfileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FFDFB0CDE04
GetFileType.KERNEL32 ref: 00007FFDFB0CDE15
__stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFB0CDE51
WriteFile.KERNEL32 ref: 00007FFDFB0CDE79
MultiByteToWideChar.KERNEL32 ref: 00007FFDFB0CDEE6
__stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFB0CE075
RegisterEventSourceW.ADVAPI32 ref: 00007FFDFB0CE094
ReportEventW.ADVAPI32 ref: 00007FFDFB0CE0D6
DeregisterEventSource.ADVAPI32 ref: 00007FFDFB0CE0DF

Strings

OpenSSL, xrefs: 00007FFDFB0CE08D
OpenSSL: FATAL, xrefs: 00007FFDFB0CE0ED
no stack?, xrefs: 00007FFDFB0CDECC
, xrefs: 00007FFDFB0CDF00

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: Event$FileSource$ByteCharDeregisterHandleMultiRegisterReportTypeWideWrite__stdio_common_vsprintf__stdio_common_vswprintf
String ID: $OpenSSL$OpenSSL: FATAL$no stack?
API String ID: 2603057392-2963566556
Opcode ID: f345fe9751aee154af01c3e1e6d1fa697fd8000db767964d7236d7de487c6ed0
Instruction ID: 8b12512ac411f2165a730c76a81f0affa9b2506bedb81515d992f7b09e519bf6
Opcode Fuzzy Hash: f345fe9751aee154af01c3e1e6d1fa697fd8000db767964d7236d7de487c6ed0
Instruction Fuzzy Hash: 2491F472B09B8382EB209F24D8605B93360FF49B94F444335EA6D07AE9EF38E255C300

Function 00007FFDFAEA1130 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 184COMMON

Download Yara Rule

APIs

_PyUnicode_EqualToASCIIId.PYTHON39 ref: 00007FFDFAEA11BF
_PyUnicode_EqualToASCIIId.PYTHON39 ref: 00007FFDFAEA11D7
_PyArg_CheckPositional.PYTHON39 ref: 00007FFDFAEA3C17
_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA3C2D
_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA3C44
_PyUnicode_EqualToASCIIId.PYTHON39 ref: 00007FFDFAEA3CAD

Part of subcall function 00007FFDFAEA12C0: PyMem_Malloc.PYTHON39 ref: 00007FFDFAEA1342

_PyArg_BadArgument.PYTHON39 ref: 00007FFDFAEA3D71

Strings

str, xrefs: 00007FFDFAEA3D63
argument 2, xrefs: 00007FFDFAEA3D53
normalize, xrefs: 00007FFDFAEA3C0A, 00007FFDFAEA3D6A
argument 1, xrefs: 00007FFDFAEA3D5C
invalid normalization form, xrefs: 00007FFDFAEA3D3D

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Unicode_$Equal$Arg_Ready$ArgumentCheckMallocMem_Positional
String ID: argument 1$argument 2$invalid normalization form$normalize$str
API String ID: 3725739812-4140678229
Opcode ID: b450521267b83ec0bbf49fde9e350a083d5fa8b3e0857ea2902bd2929478d89b
Instruction ID: d474204e688de8b17a2c74230b046c28bbdca7aa9435ea141ade896342368e08
Opcode Fuzzy Hash: b450521267b83ec0bbf49fde9e350a083d5fa8b3e0857ea2902bd2929478d89b
Instruction Fuzzy Hash: 4C71BFA5B0C68281FB6CAB199474AB923A1AF45BC4F4441B1DD7F8F6DDCF2EE8019310

Function 61B0F8F0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

PyList_New.PYTHON39 ref: 61B0F929
PyTuple_New.PYTHON39 ref: 61B0F993
PyList_New.PYTHON39 ref: 61B0F9F2
_PyList_Extend.PYTHON39 ref: 61B0FA40
_Py_Dealloc.PYTHON39 ref: 61B0FA54
PyDict_New.PYTHON39 ref: 61B0FA60
PyDict_Update.PYTHON39 ref: 61B0FADF
_Py_Dealloc.PYTHON39 ref: 61B0FAF5

Strings

Invalid type for op_build, xrefs: 61B0FB4C

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: List_$DeallocDict_$ExtendTuple_Update
String ID: Invalid type for op_build
API String ID: 3794787204-1006902009
Opcode ID: 5d3a9f82f514a1028893c82baec622d8300dba99b9e855454a4de14212b38e9d
Instruction ID: 630ab13a6db8c17df40f48c224592959fdc620cb32f36b61d6257f226eba0a49
Opcode Fuzzy Hash: 5d3a9f82f514a1028893c82baec622d8300dba99b9e855454a4de14212b38e9d
Instruction Fuzzy Hash: DB51B172705B8497FE1D8B9AA91036D2B61FB46FD6F48C52DCE1D43714EF29C4868348

Function 61B10DA0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON39 ref: 61B10DE7
PyUnicode_New.PYTHON39 ref: 61B10E04
PyObject_Format.PYTHON39 ref: 61B10F2E
_Py_Dealloc.PYTHON39 ref: 61B10F53
_Py_Dealloc.PYTHON39 ref: 61B10FE8

Strings

Too many format strings, xrefs: 61B10DDD

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Dealloc$Err_FormatObject_StringUnicode_
String ID: Too many format strings
API String ID: 3094464462-2091874682
Opcode ID: abd871ec8b6dcc8482dec338cd7dda9285344f5e9edb024f864e6e779a3327df
Instruction ID: 311fdbc2159f5c82e24c5e831bc7bd646c4594c4a42db95c49af0ab63a383d4f
Opcode Fuzzy Hash: abd871ec8b6dcc8482dec338cd7dda9285344f5e9edb024f864e6e779a3327df
Instruction Fuzzy Hash: 38518132A0DAD4C0EA1D9B66E9863AD7761F786B94F4D8525DE098771CEF29C036C340

Function 61B01A30 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 172COMMON

Download Yara Rule

APIs

PyEval_GetFrame.PYTHON39 ref: 61B01A3E
PyUnicode_AsUTF8.PYTHON39 ref: 61B01A98
PyModule_GetDict.PYTHON39 ref: 61B01AAF
PyDict_GetItemString.PYTHON39 ref: 61B01AC8
PyCFunction_GetSelf.PYTHON39 ref: 61B01AD6
PyErr_Format.PYTHON39 ref: 61B01B3C

Strings

__dict__, xrefs: 61B01B8A
__pyarmor__, xrefs: 61B01ABE
protection exception (%d), xrefs: 61B01B57, 61B01C66
%s (%d:%d), xrefs: 61B01B27

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: DictDict_Err_Eval_FormatFrameFunction_ItemModule_SelfStringUnicode_
String ID: %s (%d:%d)$__dict__$__pyarmor__$protection exception (%d)
API String ID: 3372622024-629680938
Opcode ID: c9042c23ed243da6d5f550f6f3c0c6ac5fcb0c5bba972b0dbbce67dbdeac3b6d
Instruction ID: 9b8d16f8da59197286febe7f0852669385df4d0e5ed28e7b6872a74728882d38
Opcode Fuzzy Hash: c9042c23ed243da6d5f550f6f3c0c6ac5fcb0c5bba972b0dbbce67dbdeac3b6d
Instruction Fuzzy Hash: 3B515E76701A8491FF1D9B56D8847A82F72EB89FD9F4D9825CE2D4B361EF29C096C300

Function 61B11720 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

PyFunction_NewWithQualName.PYTHON39 ref: 61B1178D
PyTuple_GetItem.PYTHON39 ref: 61B117B9
PyType_IsSubtype.PYTHON39 ref: 61B117E0
PyCMethod_New.PYTHON39 ref: 61B11835
PyTuple_SetItem.PYTHON39 ref: 61B1184F
_Py_Dealloc.PYTHON39 ref: 61B11863
_Py_Dealloc.PYTHON39 ref: 61B1187A
_Py_Dealloc.PYTHON39 ref: 61B118C7
PyCMethod_New.PYTHON39 ref: 61B1190C
Py_BuildValue.PYTHON39 ref: 61B11928

Strings

(O), xrefs: 61B11921

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Dealloc$ItemMethod_Tuple_$BuildFunction_NameQualSubtypeType_ValueWith
String ID: (O)
API String ID: 593819998-4232840684
Opcode ID: 3e2943a225880bfe03375c41d8c0273701e36c65207dde3a4d115b9b67f2ee51
Instruction ID: 0815fd226ef0d4b28c8224a78447218078cd7da639a65b5d36e747a201b33fce
Opcode Fuzzy Hash: 3e2943a225880bfe03375c41d8c0273701e36c65207dde3a4d115b9b67f2ee51
Instruction Fuzzy Hash: 3E51913260AAD081FB1D8F72E9457AA6B76F756BD0F1ED524DE5906B18DF39C052C300

Function 61B07A80 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

PyBuffer_FillInfo.PYTHON39 ref: 61B07AD3
PyMemoryView_FromBuffer.PYTHON39 ref: 61B07AE5
_PyObject_CallMethodId_SizeT.PYTHON39 ref: 61B07B09
PyNumber_AsSsize_t.PYTHON39 ref: 61B07B2B
PyErr_Occurred.PYTHON39 ref: 61B07B54
PyErr_Format.PYTHON39 ref: 61B07B7F
PyMem_Realloc.PYTHON39 ref: 61B07BB3
_Py_Dealloc.PYTHON39 ref: 61B07BF8
PyMem_Malloc.PYTHON39 ref: 61B07C23
PyErr_NoMemory.PYTHON39 ref: 61B07C35

Strings

read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61B07B6F
EOF read where not expected, xrefs: 61B07BD7

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$Mem_Memory$BufferBuffer_CallDeallocFillFormatFromInfoMallocMethodNumber_Object_OccurredReallocSizeSsize_tView_
String ID: EOF read where not expected$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 3190434935-3742967138
Opcode ID: 8ca1a984f196879fd2f02d17bac483d3836b9fe7d86ea2917728693cd5a60c8a
Instruction ID: 4b347ada7bb6f1d23960848c715b2146f020567fc1ef6fbd5babe2c722632bda
Opcode Fuzzy Hash: 8ca1a984f196879fd2f02d17bac483d3836b9fe7d86ea2917728693cd5a60c8a
Instruction Fuzzy Hash: 5441D331301E8085FA159B66E8503A8A765F745FE6F489A25CF6D477A4EF79C0EBC300

Function 61B1C450 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 319COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 61B1C690
calloc.MSVCRT ref: 61B1C6A7
free.MSVCRT ref: 61B1C6E8
free.MSVCRT ref: 61B1C6F0

Strings

kA != NULL, xrefs: 61B1CB5C
P != NULL, xrefs: 61B1C601
A != NULL, xrefs: 61B1CBA7
kB != NULL, xrefs: 61B1CB43
C != NULL, xrefs: 61B1CB75
src/pk/ecc/ltc_ecc_map.c, xrefs: 61B1C5FA
B != NULL, xrefs: 61B1CB8E
src/pk/ecc/ltc_ecc_mul2add.c, xrefs: 61B1CB23, 61B1CB3C, 61B1CB55, 61B1CB6E, 61B1CB87, 61B1CBA0
modulus != NULL, xrefs: 61B1CB2A

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: callocfree
String ID: A != NULL$B != NULL$C != NULL$P != NULL$kA != NULL$kB != NULL$modulus != NULL$src/pk/ecc/ltc_ecc_map.c$src/pk/ecc/ltc_ecc_mul2add.c
API String ID: 306872129-190324370
Opcode ID: 3cbaafa0f788e69011bfad0947c71d40fb751170d77a03a22cdc138e443baac1
Instruction ID: 3f4c28c6bbbcf4a80a304831cf36531c6052ac2d332daf2503d16a810e6c740a
Opcode Fuzzy Hash: 3cbaafa0f788e69011bfad0947c71d40fb751170d77a03a22cdc138e443baac1
Instruction Fuzzy Hash: CEC1AD32608AC486EB54CFA2E8447DE6775F789BD4F469026EE8D97718EF78C444CB40

Function 00007FFDFAFC1C1C Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 267stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB071B83
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB071CAC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB071CBF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB071E5C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB071E6F

Part of subcall function 00007FFDFB073980: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB073A43
Part of subcall function 00007FFDFB073980: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB073A5B
Part of subcall function 00007FFDFB073980: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB073A78

Strings

..\s\crypto\asn1\asn_mime.c, xrefs: 00007FFDFB071AFB, 00007FFDFB071C3D, 00007FFDFB071CD5, 00007FFDFB071D51, 00007FFDFB071DD5, 00007FFDFB071E07, 00007FFDFB071E85, 00007FFDFB071F0C
application/pkcs7-mime, xrefs: 00007FFDFB071E65
application/x-pkcs7-mime, xrefs: 00007FFDFB071E52
type: , xrefs: 00007FFDFB071CEE, 00007FFDFB071E9E
multipart/signed, xrefs: 00007FFDFB071B79
application/pkcs7-signature, xrefs: 00007FFDFB071CB5
application/x-pkcs7-signature, xrefs: 00007FFDFB071CA2
boundary, xrefs: 00007FFDFB071B94
content-type, xrefs: 00007FFDFB071B34

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: strcmp$strncmp
String ID: ..\s\crypto\asn1\asn_mime.c$application/pkcs7-mime$application/pkcs7-signature$application/x-pkcs7-mime$application/x-pkcs7-signature$boundary$content-type$multipart/signed$type:
API String ID: 1244041713-3630080479
Opcode ID: 7ebc3a45523df780ecbf5d5eee50afa3b023d1eb5b1fbd1f84c6fabd0e5d4c90
Instruction ID: 9592b08d84e125deb5f06c675fdf021fa690552221937dc3171b06686c353e7e
Opcode Fuzzy Hash: 7ebc3a45523df780ecbf5d5eee50afa3b023d1eb5b1fbd1f84c6fabd0e5d4c90
Instruction Fuzzy Hash: E9C19E61B0D24751FB24EB12A460EB9A3A1EF86B94F549131E92D0B7EEDF3CE605D700

Function 00007FFDFAFC1F69 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 135COMMON

Download Yara Rule

Strings

..\s\crypto\rand\randfile.c, xrefs: 00007FFDFB18E172, 00007FFDFB18E1D1, 00007FFDFB18E2DC
i, xrefs: 00007FFDFB18E1C9
Filename=, xrefs: 00007FFDFB18E193, 00007FFDFB18E1E7, 00007FFDFB18E2FD

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID:
String ID: ..\s\crypto\rand\randfile.c$Filename=$i
API String ID: 0-1799673945
Opcode ID: 7d1977694894f8042029fe63fd36c3481b6e532379de41e032ad477ae45bac35
Instruction ID: 930e5c4d9f7858ae6913e50e0f93b617dddf2c0e39606ea23a27a6e62a102ec6
Opcode Fuzzy Hash: 7d1977694894f8042029fe63fd36c3481b6e532379de41e032ad477ae45bac35
Instruction Fuzzy Hash: 0251A522F0DA4386F714EB15D860A7A63A1FF89B88F444135E96D4B6EDEF3CE5058701

Function 00007FF799671440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON

Download Yara Rule

Strings

fseek, xrefs: 00007FF799671500
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF799671559
fwrite, xrefs: 00007FF7996715DC
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7996714F9
malloc, xrefs: 00007FF799671560
fopen, xrefs: 00007FF799671491
fread, xrefs: 00007FF7996715EC
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7996715D5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7996714CA
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7996715E5
Failed to extract %s: failed to open target file!, xrefs: 00007FF79967148A

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: b665b256f8f74031ebff00b00e7ffbf71a07c123787cadc40d721d792f853b1b
Instruction ID: 431e0b96d680a771f388b5a51257a13207570ef71a798b34e7d1a9979dfd1b16
Opcode Fuzzy Hash: b665b256f8f74031ebff00b00e7ffbf71a07c123787cadc40d721d792f853b1b
Instruction Fuzzy Hash: AA518865A0974281FA30BF35E5046B9A3B2AF45BD4FC54132DE2D4779AEE3CE6858320

Function 61B7CF50 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 123fileCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 61B7CFAE
CreateFileMappingA.KERNEL32 ref: 61B7D005
MapViewOfFile.KERNEL32 ref: 61B7D031
CloseHandle.KERNEL32 ref: 61B7D03D
GetLastError.KERNEL32 ref: 61B7D048
_errno.MSVCRT ref: 61B7D050

Strings

@, xrefs: 61B7D10D
, xrefs: 61B7CF8C
@, xrefs: 61B7D0B4

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: File_errno$CloseCreateErrorHandleLastMappingView
String ID: $@$@
API String ID: 896588047-3743272326
Opcode ID: 8c5352527e7b86c1f137caadf43ac438e7407e9b3af5fa1e0f41d598a61b0f11
Instruction ID: 5e26c78caa93fa4c6daeca62d423b8ea948e99d1822da1dc052966d65739ad3e
Opcode Fuzzy Hash: 8c5352527e7b86c1f137caadf43ac438e7407e9b3af5fa1e0f41d598a61b0f11
Instruction Fuzzy Hash: FE4125B3A1569049FB365B96BC007896911B78ABF4F499326EF795B7D0EB3CC881C300

Function 61B10BD0 Relevance: 21.1, APIs: 14, Instructions: 93COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON39 ref: 61B10C01
PyErr_Fetch.PYTHON39 ref: 61B10C3F
PyErr_NormalizeException.PYTHON39 ref: 61B10C57
PyException_SetTraceback.PYTHON39 ref: 61B10C79
_Py_Dealloc.PYTHON39 ref: 61B10C9B
PyErr_NormalizeException.PYTHON39 ref: 61B10CAA
PyException_SetContext.PYTHON39 ref: 61B10CB9
PyErr_Restore.PYTHON39 ref: 61B10CCE
PyErr_Restore.PYTHON39 ref: 61B10CFB
_Py_Dealloc.PYTHON39 ref: 61B10D03
PyEval_GetFrame.PYTHON39 ref: 61B10D10
PyErr_Restore.PYTHON39 ref: 61B10D38
PyTraceBack_Here.PYTHON39 ref: 61B10D43
PyErr_Fetch.PYTHON39 ref: 61B10D57

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$Restore$DeallocExceptionException_FetchNormalize$Back_ContextEval_FrameHereOccurredTraceTraceback
String ID:
API String ID: 4214459649-0
Opcode ID: c368ba221dffe94a581079cb90e5fd2acaa62b293e5c09470adb001c49ae980b
Instruction ID: dc2592a7a8579d1e295491155b46764e0925141968f26c37d368aa23bd2b37ac
Opcode Fuzzy Hash: c368ba221dffe94a581079cb90e5fd2acaa62b293e5c09470adb001c49ae980b
Instruction Fuzzy Hash: 41310A76209BC494EA259B56F84439FB732F786BD0F589416DE8D93B28CF39C056CB01

Function 00007FFDFAEA2410 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 41COMMON

Download Yara Rule

APIs

PyModule_Create2.PYTHON39 ref: 00007FFDFAEA2430
PyModule_AddStringConstant.PYTHON39 ref: 00007FFDFAEA2453
PyModule_AddObject.PYTHON39 ref: 00007FFDFAEA2471

Part of subcall function 00007FFDFAEA24D0: _PyObject_New.PYTHON39(?,?,?,?,00007FFDFAEA247C), ref: 00007FFDFAEA24DB

PyModule_AddObject.PYTHON39 ref: 00007FFDFAEA248E
PyCapsule_New.PYTHON39 ref: 00007FFDFAEA24A5
PyModule_AddObject.PYTHON39 ref: 00007FFDFAEA24BD

Strings

unicodedata.ucnhash_CAPI, xrefs: 00007FFDFAEA2497
13.0.0, xrefs: 00007FFDFAEA2442
unidata_version, xrefs: 00007FFDFAEA244C
ucd_3_2_0, xrefs: 00007FFDFAEA2484
ucnhash_CAPI, xrefs: 00007FFDFAEA24B3
UCD, xrefs: 00007FFDFAEA2467

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Module_$Object$Capsule_ConstantCreate2Object_String
String ID: 13.0.0$UCD$ucd_3_2_0$ucnhash_CAPI$unicodedata.ucnhash_CAPI$unidata_version
API String ID: 3760240918-3451515483
Opcode ID: 9404a3e0a00de817f514e66c0451751c0b59d428688e7b36f43c78fa1897eb59
Instruction ID: 2fb346ec45fc4a0a62f50c9716cd3109b7e2e657b2ccf360810b718e591e880d
Opcode Fuzzy Hash: 9404a3e0a00de817f514e66c0451751c0b59d428688e7b36f43c78fa1897eb59
Instruction Fuzzy Hash: D811F8A4B09B4791EF0CAB15E8709B52760BF96B51B4450B2C83F1E3E9EF2EA549C350

Function 61B11D60 Relevance: 19.6, APIs: 13, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 61B11D83
HeapAlloc.KERNEL32 ref: 61B11D97
GetAdaptersAddresses.IPHLPAPI ref: 61B11DBF
inet_ntoa.WS2_32 ref: 61B11DF7
GetProcessHeap.KERNEL32 ref: 61B11E12
HeapFree.KERNEL32 ref: 61B11E1C
GetProcessHeap.KERNEL32 ref: 61B11E30
HeapFree.KERNEL32 ref: 61B11E3A
GetProcessHeap.KERNEL32 ref: 61B11E40
HeapAlloc.KERNEL32 ref: 61B11E4A
GetAdaptersAddresses.IPHLPAPI ref: 61B11E69

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Heap$Process$AdaptersAddressesAllocFree$inet_ntoa
String ID:
API String ID: 4108032510-0
Opcode ID: d16a3b648359f659fd2c73b0afce29e08999a610ff9235240c5c21818b975687
Instruction ID: 96fe857e273d88828c28fac541a6b51d8e9f740912febbed53996c4096d15195
Opcode Fuzzy Hash: d16a3b648359f659fd2c73b0afce29e08999a610ff9235240c5c21818b975687
Instruction Fuzzy Hash: 1F21FD2331968545FB58DBF7AC01B5A6A62AB89BD4F0DC639AD1C87398DF38D4428710

Function 61B04701 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 163threadCOMMON

Download Yara Rule

APIs

Part of subcall function 61B0E870: PyList_New.PYTHON39 ref: 61B0E8AA
Part of subcall function 61B0E870: PyMem_Free.PYTHON39 ref: 61B0E8E3

_PyDict_GetItemIdWithError.PYTHON39 ref: 61B0F2D2
PyThreadState_Get.PYTHON39 ref: 61B0F335
_Py_CheckFunctionResult.PYTHON39 ref: 61B0F37F
_Py_Dealloc.PYTHON39 ref: 61B0F3B3
_PyObject_MakeTpCall.PYTHON39 ref: 61B0F40A
_Py_Dealloc.PYTHON39 ref: 61B0F420
_PyLong_AsInt.PYTHON39 ref: 61B0F463
PyImport_ImportModuleLevelObject.PYTHON39 ref: 61B0F48B
_Py_Dealloc.PYTHON39 ref: 61B0F4BD

Strings

__import__ not found, xrefs: 61B0F43C

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Dealloc$CallCheckDict_ErrorFreeFunctionImportImport_ItemLevelList_Long_MakeMem_ModuleObjectObject_ResultState_ThreadWith
String ID: __import__ not found
API String ID: 1035092831-2199325508
Opcode ID: f69035f3f3d1c36941beb47acd8e15956824a91dfce60674d61ed92d0351f915
Instruction ID: 4c4f414a092636a8af3c19606606fbd00ee5c3b8fe9c95db7cb9c0abd797cef7
Opcode Fuzzy Hash: f69035f3f3d1c36941beb47acd8e15956824a91dfce60674d61ed92d0351f915
Instruction Fuzzy Hash: 25516E72305B8486EA498F56E84439E7B61F74AFE5F08912ADF4E07B24DF39C0A5C304

Function 61B119E0 Relevance: 18.1, APIs: 12, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 61B11A01
HeapAlloc.KERNEL32 ref: 61B11A16
memcpy.MSVCRT ref: 61B11A8C
GetProcessHeap.KERNEL32 ref: 61B11AAA
HeapFree.KERNEL32 ref: 61B11AB5
GetProcessHeap.KERNEL32 ref: 61B11ACA
HeapFree.KERNEL32 ref: 61B11AD5
GetProcessHeap.KERNEL32 ref: 61B11AF0
HeapFree.KERNEL32 ref: 61B11AFB
GetProcessHeap.KERNEL32 ref: 61B11B05
HeapAlloc.KERNEL32 ref: 61B11B10
GetAdaptersAddresses.IPHLPAPI ref: 61B11B2C

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Heap$Process$Free$Alloc$AdaptersAddressesmemcpy
String ID:
API String ID: 1739390247-0
Opcode ID: a7d6ca7c7a7af3b07c737d82dffe7c83959938c8e8550f1ccbda524bf3299739
Instruction ID: 8de235b32370fc304316d942d2e3e465cf26d4b928804fb5ee54078b8abbffdf
Opcode Fuzzy Hash: a7d6ca7c7a7af3b07c737d82dffe7c83959938c8e8550f1ccbda524bf3299739
Instruction Fuzzy Hash: E031D82331568189EF09DBB6A800B9D6BA2D75ABD4F4CC139EE2887718EF34C591C700

Function 61B7D7E0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 283memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,61B01278), ref: 61B7D90D

Strings

Unknown pseudo relocation bit size %d., xrefs: 61B7DA7A
Unknown pseudo relocation protocol version %d., xrefs: 61B7DA8E

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: e7dcead3da33c0d97bd82a4463277e03bd00bfc50d6c47c3edb4fd3113abe840
Instruction ID: 502e67a30c415de938d6f45c645901a6d13cd530305282750e6e89115e7c7d7e
Opcode Fuzzy Hash: e7dcead3da33c0d97bd82a4463277e03bd00bfc50d6c47c3edb4fd3113abe840
Instruction Fuzzy Hash: 5C911471B102C186FB3C9BA6E98079D6762FB857E8F54C915CA3D97794EB3EC4828301

Function 61B13930 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 117stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 61B1394A
malloc.MSVCRT ref: 61B13956
memcpy.MSVCRT ref: 61B13975
strchr.MSVCRT ref: 61B13A54
free.MSVCRT ref: 61B13A86

Strings

local, xrefs: 61B139C3
and,, xrefs: 61B13983
http://, xrefs: 61B139E1
or,, xrefs: 61B1398A

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: freemallocmemcpystrchrstrlen
String ID: and,$http://$local$or,
API String ID: 3771145599-2506292620
Opcode ID: 98aea5e60080652496146f5ca2e7bc1ace9f850ca94594126baf6f624212a160
Instruction ID: 8f254e6f1fd28203d4179a1ed8483321e480ab26beec3d8740840233e448d8d7
Opcode Fuzzy Hash: 98aea5e60080652496146f5ca2e7bc1ace9f850ca94594126baf6f624212a160
Instruction Fuzzy Hash: B031F82275D2C481FE59CA5255013AD6B45E741BF8F8DC7258D39177E9FB3AC046C300

Function 61B096B5 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON39 ref: 61B096C6
PyList_New.PYTHON39 ref: 61B09FE0

Strings

bad marshal data (list size out of range), xrefs: 61B0A3F8
NULL object in marshal data for list, xrefs: 61B0AAE5

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_List_Occurred
String ID: NULL object in marshal data for list$bad marshal data (list size out of range)
API String ID: 1902535023-3453879413
Opcode ID: 5deaa9ae589fbd167d0c6d4827ad7f0891c85d593059ce57b5833c872caed8f3
Instruction ID: 72ef1453551cd2915ee9601d540d127adae4d508a2b054f58b71238257ab7bf8
Opcode Fuzzy Hash: 5deaa9ae589fbd167d0c6d4827ad7f0891c85d593059ce57b5833c872caed8f3
Instruction Fuzzy Hash: 62314B712466D1C2EA18CB66E48435D2BB5FB8AB92F08D825CE4E07324EF39C446CB40

Function 61B09820 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON39 ref: 61B09831
PyTuple_New.PYTHON39 ref: 61B09EB2

Strings

bad marshal data (tuple size out of range), xrefs: 61B0A6D4
NULL object in marshal data for tuple, xrefs: 61B0A913

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_OccurredTuple_
String ID: NULL object in marshal data for tuple$bad marshal data (tuple size out of range)
API String ID: 3674511531-3094253248
Opcode ID: 66e4071a65e2e3d8afc3ba7a2e60ce4719a528bf4bb790b3b2f123e2c83be233
Instruction ID: 6bc3a64c7aec1e082c96986ab5144d91af66bcd782cc1a484e51d603226bf779
Opcode Fuzzy Hash: 66e4071a65e2e3d8afc3ba7a2e60ce4719a528bf4bb790b3b2f123e2c83be233
Instruction Fuzzy Hash: CD214B712067C181FA188B66D49476D3BA6FB86B92F09EC14CE0E07324EF39D845C750

Function 61B08980 Relevance: 16.8, APIs: 11, Instructions: 338fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61B08CB1

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: fwrite
String ID:
API String ID: 3559309478-0
Opcode ID: 590e91543fc90559786f37e0cf4ea6d173d7f06c6baca5210b17f63ad982adca
Instruction ID: f050a4670b52e395e798ff82b4e410f23e6159c21e29f92d3365b1949e6b1733
Opcode Fuzzy Hash: 590e91543fc90559786f37e0cf4ea6d173d7f06c6baca5210b17f63ad982adca
Instruction Fuzzy Hash: 00C1ADB2701B8485DB19CFAAD4447893BB5F309FE9F648216DE6C1B798DB39C691C380

Function 00007FFDFAEA2610 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDFAEA2638
__scrt_initialize_crt.LIBCMT ref: 00007FFDFAEA267D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDFAEA268A
_RTC_Initialize.LIBCMT ref: 00007FFDFAEA26B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDFAEA26DE
__scrt_release_startup_lock.LIBCMT ref: 00007FFDFAEA2709

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: b8c1a2c7ebbee062cdffbadaee7b374dce9ca1f85f88613488d49a9c17cf69b8
Instruction ID: 1e20faa0d406596d57b8b8af6ece9bd82982c0e1dadbea89f76fd8180103f3df
Opcode Fuzzy Hash: b8c1a2c7ebbee062cdffbadaee7b374dce9ca1f85f88613488d49a9c17cf69b8
Instruction Fuzzy Hash: C881C0A1F0C24345F75CBB269460AB95290AF95B80F0480B5E96F6F7EEDF3EE505A700

Function 00007FFDFAFC32AB Relevance: 16.6, APIs: 5, Strings: 6, Instructions: 127stringCOMMON

Download Yara Rule

APIs

atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFB1BAD4C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1BAD61
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFB1BAD73

Strings

millisecs, xrefs: 00007FFDFB1BAD57
secs, xrefs: 00007FFDFB1BAD1D
p, xrefs: 00007FFDFB1BAE04
microsecs, xrefs: 00007FFDFB1BAD7E
..\s\crypto\ts\ts_conf.c, xrefs: 00007FFDFB1BACC0, 00007FFDFB1BAE0C
accuracy, xrefs: 00007FFDFB1BAC83, 00007FFDFB1BACD3, 00007FFDFB1BAE24

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: atoi$strcmp
String ID: ..\s\crypto\ts\ts_conf.c$accuracy$microsecs$millisecs$p$secs
API String ID: 4175852868-1596076588
Opcode ID: ae98376ed62e7f2547e13ed3231a9dc688f41d63b3bfb75b3373190d81aa6424
Instruction ID: 29b87cd2eeddd0aeb1944fc34f58dcd0c42501acbaa657093a64899eeaa4edd0
Opcode Fuzzy Hash: ae98376ed62e7f2547e13ed3231a9dc688f41d63b3bfb75b3373190d81aa6424
Instruction Fuzzy Hash: D051B326F1A64756EB04AB269430DB93390BF44B98F409635ED2E477F9DF3CE5058600

Function 61B09850 Relevance: 16.6, APIs: 11, Instructions: 84COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON39 ref: 61B09850
PyList_Append.PYTHON39 ref: 61B09C61
PyDict_SetItem.PYTHON39 ref: 61B09CB7
_Py_Dealloc.PYTHON39 ref: 61B09CDC
_Py_Dealloc.PYTHON39 ref: 61B09CE6
_Py_Dealloc.PYTHON39 ref: 61B09CFF
_Py_Dealloc.PYTHON39 ref: 61B09D0E
PyErr_Occurred.PYTHON39 ref: 61B09D14
_Py_Dealloc.PYTHON39 ref: 61B09D35

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Dealloc$Dict_$AppendErr_ItemList_Occurred
String ID:
API String ID: 30499974-0
Opcode ID: 0ee05b1e747ac9e08a2086f116a859a3cc3a2e4e8626090a5f169c33c492e374
Instruction ID: 3ac32a370ddc71d74ff73bb4ff5e518c97c46a56d873f418bfa8530d8794377f
Opcode Fuzzy Hash: 0ee05b1e747ac9e08a2086f116a859a3cc3a2e4e8626090a5f169c33c492e374
Instruction Fuzzy Hash: 98316F72A46BD081EA1D8F67E9543596BA5F78AB96F0CD824CE4E47324DF39C0018350

Function 61B12160 Relevance: 16.6, APIs: 11, Instructions: 78memorynetworkCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 61B1217B
HeapAlloc.KERNEL32 ref: 61B1218F
GetNetworkParams.IPHLPAPI ref: 61B121C7
GetProcessHeap.KERNEL32 ref: 61B121E9
HeapFree.KERNEL32 ref: 61B121F3
GetProcessHeap.KERNEL32 ref: 61B12210
HeapFree.KERNEL32 ref: 61B1221A
GetProcessHeap.KERNEL32 ref: 61B12221
HeapAlloc.KERNEL32 ref: 61B1222B
GetProcessHeap.KERNEL32 ref: 61B12246
HeapFree.KERNEL32 ref: 61B12250

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Heap$Process$Free$Alloc$NetworkParams
String ID:
API String ID: 3483679945-0
Opcode ID: aefcdaee9a6d941e5cea11ce6d157eb645c84eed3e1b7f40b0a921879ae0bc52
Instruction ID: bbadbd92d175af840e26784c3679636ff142011b10d8cc43dd9c51b82f17ebdb
Opcode Fuzzy Hash: aefcdaee9a6d941e5cea11ce6d157eb645c84eed3e1b7f40b0a921879ae0bc52
Instruction Fuzzy Hash: 8811E95530559644EE18D7B77C01BAE96526BCBBD4F1DC236AE3C97398EE38D1038300

Function 61B01660 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON39 ref: 61B016ED
PyErr_Occurred.PYTHON39 ref: 61B0178E

Strings

%s (%d:%d), xrefs: 61B016DB

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$FormatOccurred
String ID: %s (%d:%d)
API String ID: 4038069558-1595188566
Opcode ID: 6bdcaf1c84afebc70da9eedde274f8b37b3cc79f71d39b15753354c2fabf8bce
Instruction ID: 81413b3c93e81ebaca8c79e3421e12b8a91048c5583085990c376c29da13226b
Opcode Fuzzy Hash: 6bdcaf1c84afebc70da9eedde274f8b37b3cc79f71d39b15753354c2fabf8bce
Instruction Fuzzy Hash: 7241BE726057C082EB0C9B5AE8913AD7F71F78ABD9F4CD525EE4A07B25CF29C1858740

Function 61B7DD30 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 61B7DD89
signal.MSVCRT ref: 61B7DDE2
signal.MSVCRT ref: 61B7DE3E
signal.MSVCRT ref: 61B7DEF3

Strings

CCG , xrefs: 61B7DD45

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 83dfee6b8079288d274c6ade54bcbf9715db9cea21a8ecb3a62078a186a6545f
Instruction ID: e90b821d2f5e3d69e45083a416f6e74094f7ac85f604431b1f10de08303f00e8
Opcode Fuzzy Hash: 83dfee6b8079288d274c6ade54bcbf9715db9cea21a8ecb3a62078a186a6545f
Instruction Fuzzy Hash: 4C315E207054C146FE7E62FAA59036D2542EBDA3B8F29CF25C93EC73E4DE5988D54322

Function 61B092D0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON39 ref: 61B092E0
PyUnicode_DecodeUTF8.PYTHON39 ref: 61B09BAF

Strings

surrogatepass, xrefs: 61B09BA5
bad marshal data (string size out of range), xrefs: 61B0A375

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: DecodeErr_OccurredUnicode_
String ID: bad marshal data (string size out of range)$surrogatepass
API String ID: 1138423624-4021928140
Opcode ID: 35757d6065978158dbef02c5d6e94a5f31814075426dee35622a1944adce035a
Instruction ID: 7eccf157815502c72e4032eb7b92d0fcf92db7c6a2433d5e7de302b1b18528bb
Opcode Fuzzy Hash: 35757d6065978158dbef02c5d6e94a5f31814075426dee35622a1944adce035a
Instruction Fuzzy Hash: A83185723456C086EA19CF25E49479E7BA5FB89B52F0AE924CE4A07354DF38D485CB40

Function 00007FFDFAEA5208 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA5235
_PyUnicode_EqualToASCIIId.PYTHON39 ref: 00007FFDFAEA5271
PyUnicode_Compare.PYTHON39 ref: 00007FFDFAEA52D4
_Py_Dealloc.PYTHON39 ref: 00007FFDFAEA52E5
_PyUnicode_EqualToASCIIId.PYTHON39 ref: 00007FFDFAEA52F9
_PyUnicode_EqualToASCIIId.PYTHON39 ref: 00007FFDFAEA5319
_PyUnicode_EqualToASCIIId.PYTHON39 ref: 00007FFDFAEA5331
PyErr_SetString.PYTHON39 ref: 00007FFDFAEA5354

Strings

invalid normalization form, xrefs: 00007FFDFAEA534A

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Unicode_$Equal$CompareDeallocErr_ReadyString
String ID: invalid normalization form
API String ID: 3010910608-2281882113
Opcode ID: ba4c5c826613feff4fda7b3b67ec7b853ca24e194141179678075e2ef9f1e7e6
Instruction ID: 5bcbd034f2f65302054d519778e85787d3929ef246a7419d80a1b3d64bf9ef9a
Opcode Fuzzy Hash: ba4c5c826613feff4fda7b3b67ec7b853ca24e194141179678075e2ef9f1e7e6
Instruction Fuzzy Hash: 034172A1B0860285EB18AB15A860A756364FF86F94F4401B5DD7F4F7ECDF7EE0049320

Function 00007FFDFAFC23D3 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFDFB0CDC28
GetProcAddress.KERNEL32 ref: 00007FFDFB0CDC3D
GetProcessWindowStation.USER32 ref: 00007FFDFB0CDC67
GetUserObjectInformationW.USER32 ref: 00007FFDFB0CDC8F
GetLastError.KERNEL32 ref: 00007FFDFB0CDC9D
GetUserObjectInformationW.USER32 ref: 00007FFDFB0CDD08
wcsstr.VCRUNTIME140 ref: 00007FFDFB0CDD30

Strings

_OPENSSL_isservice, xrefs: 00007FFDFB0CDC33
Service-0x, xrefs: 00007FFDFB0CDD29

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindowwcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 459917433-1672312481
Opcode ID: b0e2507b54a2fee0f286af568643ff84d15fb4472f624db1291a1182b8891a4e
Instruction ID: ca0ef295e88d473552541deb0329cd4a5517a88037e4d427c35936a0a5c4a142
Opcode Fuzzy Hash: b0e2507b54a2fee0f286af568643ff84d15fb4472f624db1291a1182b8891a4e
Instruction Fuzzy Hash: 65417F61B06B8386EB549F25D860AB823A0EF497B4B484735E97D467F8EF3CE5548300

Function 61B07470 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63stringCOMMON

Download Yara Rule

APIs

PyErr_SetFromWindowsErr.PYTHON39 ref: 61B0749E
PyErr_Fetch.PYTHON39 ref: 61B074B3
PyErr_Restore.PYTHON39 ref: 61B074C8
PyObject_Str.PYTHON39 ref: 61B074D8
strerror.MSVCRT ref: 61B074E5
PyErr_Format.PYTHON39 ref: 61B07521

Strings

%s (%d:%d), xrefs: 61B07514

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$FetchFormatFromObject_RestoreWindowsstrerror
String ID: %s (%d:%d)
API String ID: 2858978339-1595188566
Opcode ID: e76e97b5667d219b5e8a1efab1be7d93002fe32716a7f533a54dc1823c019955
Instruction ID: 303276164d2b28656eba6fd409e0f585d2b665e41c123d5ec827297777a7d94f
Opcode Fuzzy Hash: e76e97b5667d219b5e8a1efab1be7d93002fe32716a7f533a54dc1823c019955
Instruction Fuzzy Hash: 6121B332605BC481EB089B1AE4503DD7B72FB8AB91F499826CF8E17364DF2AC546C340

Function 00007FFDFAEA511C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON39 ref: 00007FFDFAEA5148
_PyArg_BadArgument.PYTHON39 ref: 00007FFDFAEA517D
_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA518D
_PyArg_BadArgument.PYTHON39 ref: 00007FFDFAEA51CC
_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA51DC

Strings

str, xrefs: 00007FFDFAEA5168, 00007FFDFAEA51B7
is_normalized, xrefs: 00007FFDFAEA513B, 00007FFDFAEA516F, 00007FFDFAEA51BE
argument 2, xrefs: 00007FFDFAEA51C5
argument 1, xrefs: 00007FFDFAEA5176

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Arg_$ArgumentReadyUnicode_$CheckPositional
String ID: argument 1$argument 2$is_normalized$str
API String ID: 396090033-184702317
Opcode ID: f80971bf26c3f3c62d97a1cd1428008a854b5e9fc8dea6ffb44fcbe9bdb378be
Instruction ID: 404cf0b9a65712821d47f302f5bcdec28c9a688baed77f94a9a15b071a0bf122
Opcode Fuzzy Hash: f80971bf26c3f3c62d97a1cd1428008a854b5e9fc8dea6ffb44fcbe9bdb378be
Instruction Fuzzy Hash: 2521B661B0CA8684E7189B25E864AB82364FF56F94F4442B1D97F0F2ECCF2DD506C310

Function 61B0E530 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON39 ref: 61B0E53F
fread.MSVCRT ref: 61B0E562
PyMem_Free.PYTHON39 ref: 61B0E582
PyErr_Occurred.PYTHON39 ref: 61B0E592
PyErr_Format.PYTHON39 ref: 61B0E5C2
PyErr_NoMemory.PYTHON39 ref: 61B0E5F0

Strings

read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61B0E5B8
EOF read where not expected, xrefs: 61B0E5D7

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$Mem_$FormatFreeMallocMemoryOccurredfread
String ID: EOF read where not expected$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 28673812-3742967138
Opcode ID: 5c196552dab230829ee26b30c8cd0ab159bfc67585371228b6031577619417f4
Instruction ID: dd9a14458220e394acffc043ebbebb36bf8dfbb8b44ee53497f36c4f210d1c3b
Opcode Fuzzy Hash: 5c196552dab230829ee26b30c8cd0ab159bfc67585371228b6031577619417f4
Instruction Fuzzy Hash: F411C23070569081FA188B6BE88439C1A62B74AF92F0C9E21CEAD473E0FF2EC5568300

Function 00007FF7996774B0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF7996726A0), ref: 00007FF7996774D7
FormatMessageW.KERNEL32(00000000,00007FF7996726A0), ref: 00007FF799677506
WideCharToMultiByte.KERNEL32 ref: 00007FF79967755C

Part of subcall function 00007FF799672620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF799677744,?,?,?,?,?,?,?,?,?,?,?,00007FF79967101D), ref: 00007FF799672654
Part of subcall function 00007FF799672620: MessageBoxW.USER32 ref: 00007FF79967272C

Strings

No error messages generated., xrefs: 00007FF799677510
FormatMessageW, xrefs: 00007FF799677517
PyInstaller: FormatMessageW failed., xrefs: 00007FF799677523
Failed to encode wchar_t as UTF-8., xrefs: 00007FF799677566
WideCharToMultiByte, xrefs: 00007FF79967756D
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF799677579

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction ID: fb7703c45835701ef563cd127fffc2657897b76f74b9e454fbf81cb824c42b0b
Opcode Fuzzy Hash: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction Fuzzy Hash: FB211071A18B4282F770AF35E854266A3B7FB88384FC40135D56D82795EF7CE545C760

Function 61B0E600 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON39 ref: 61B0E60F
fread.MSVCRT ref: 61B0E632
PyMem_Free.PYTHON39 ref: 61B0E645
PyErr_Occurred.PYTHON39 ref: 61B0E655
PyErr_Format.PYTHON39 ref: 61B0E685
PyErr_NoMemory.PYTHON39 ref: 61B0E6B0

Strings

read() returned too much data: %zd bytes requested, %zd returned, xrefs: 61B0E67B
EOF read where not expected, xrefs: 61B0E697

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$Mem_$FormatFreeMallocMemoryOccurredfread
String ID: EOF read where not expected$read() returned too much data: %zd bytes requested, %zd returned
API String ID: 28673812-3742967138
Opcode ID: 6cd963c7d8042f78008add91214353f4f50e3c349a8d10f296dd955fc68ac947
Instruction ID: 0cf751e1b2cd42544234907615a75a55186e287cfd1db188ed2d49f761de8941
Opcode Fuzzy Hash: 6cd963c7d8042f78008add91214353f4f50e3c349a8d10f296dd955fc68ac947
Instruction Fuzzy Hash: 3C115B7170559081FA089B6BFC5439C1622BB46FA5F0C9A25EE5E177E0DF3A88968340

Function 61B1D690 Relevance: 15.5, APIs: 2, Strings: 8, Instructions: 455COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 61B1D733
free.MSVCRT ref: 61B1D7E1

Strings

in != NULL, xrefs: 61B1DB13
key != NULL, xrefs: 61B1DD03
key != NULL, xrefs: 61B1DAFA
ltc_mp.name != NULL, xrefs: 61B1DAE1
src/pk/rsa/rsa_import.c, xrefs: 61B1DADA, 61B1DAF3, 61B1DB0C
ltc_mp.name != NULL, xrefs: 61B1DD1C
src/pk/rsa/rsa_make_key.c, xrefs: 61B1DCFC, 61B1DD15, 61B1DD2E
size > 0, xrefs: 61B1DD35

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: callocfree
String ID: in != NULL$key != NULL$key != NULL$ltc_mp.name != NULL$ltc_mp.name != NULL$size > 0$src/pk/rsa/rsa_import.c$src/pk/rsa/rsa_make_key.c
API String ID: 306872129-2031961738
Opcode ID: 122f9fe6c474a09e7fb308f08be724e57a1a5cd14cf12406ef073a396dfed3e3
Instruction ID: c58b955f1d6f9c4311833bf8ef6524a99477435119d902af924920aa39d4d61d
Opcode Fuzzy Hash: 122f9fe6c474a09e7fb308f08be724e57a1a5cd14cf12406ef073a396dfed3e3
Instruction Fuzzy Hash: DB123972208BC186E7648F62F48578EB7A4F785B98F518116EF8A87B5CDF79C085CB40

Function 00007FFDFAFC4B3D Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 127stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1F384D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1F38B0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1F38DF

Strings

/, xrefs: 00007FFDFB1F3968
DER:, xrefs: 00007FFDFB1F38A6
name=, xrefs: 00007FFDFB1F3992
ASN1:, xrefs: 00007FFDFB1F38D5
..\s\crypto\x509v3\v3_conf.c, xrefs: 00007FFDFB1F3970
, value=, xrefs: 00007FFDFB1F3983
critical,, xrefs: 00007FFDFB1F3846

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: strncmp
String ID: , value=$..\s\crypto\x509v3\v3_conf.c$/$ASN1:$DER:$critical,$name=
API String ID: 1114863663-1429737502
Opcode ID: fa9dcb5958271daa3e2a324d8ca326ef0272130a5644930e9fe95100a0dccc46
Instruction ID: 45da4dbc829013f5f2fd1b12d7c309bbf9952e74ecb5829ceb5ee2604a855d01
Opcode Fuzzy Hash: fa9dcb5958271daa3e2a324d8ca326ef0272130a5644930e9fe95100a0dccc46
Instruction Fuzzy Hash: 2141C162F0AA8741EB149B22B820B7A6A90FF45BD8F045235DD6D4B7EDDE3CE505C700

Function 00007FF799680228 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF799680268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF799680630
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7996808CF

Strings

p, xrefs: 00007FF799680372
f, xrefs: 00007FF7996804B5
p, xrefs: 00007FF79968030D
f, xrefs: 00007FF799680300
f, xrefs: 00007FF79968036A

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction ID: 81cff7df6d6c556f5b8e30e0c4cfa7491e3a93097ea40b906064c210628f2328
Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction Fuzzy Hash: 921281A2E0D143C6FB707E26E1542FAE2B3FB80750FD44835D6A9466C4DB7CE4818B61

Function 61B013C0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

PySys_GetObject.PYTHON39 ref: 61B0158B
PyUnicode_AsUTF8AndSize.PYTHON39 ref: 61B0159B
getenv.MSVCRT ref: 61B015BB

Strings

PYARMOR_LANG, xrefs: 61B01565
LANG, xrefs: 61B015B4
_PARLANG, xrefs: 61B01584, 61B0162C

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: ObjectSizeSys_Unicode_getenv
String ID: LANG$PYARMOR_LANG$_PARLANG
API String ID: 223123148-1822377752
Opcode ID: e3ea14bb12fd1e93d48e2f2833b79d1dc149f78145d73b0252fa14395f8fae87
Instruction ID: 0b2dfe9e6bd145d7a43b91fd87f49a53445e9401d3cb0163b88a1a6a79ae2dc7
Opcode Fuzzy Hash: e3ea14bb12fd1e93d48e2f2833b79d1dc149f78145d73b0252fa14395f8fae87
Instruction Fuzzy Hash: 0451E3A22092E085FB4ECBA5D4803AD3FB3E746B8EF4EC016DA5D07365D72AC099C710

Function 00007FFDFAFC41D8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFDFB08A79E
WSAGetLastError.WS2_32 ref: 00007FFDFB08A7A8

Strings

..\s\crypto\bio\b_sock2.c, xrefs: 00007FFDFB08A72E, 00007FFDFB08A7BE, 00007FFDFB08A7DA, 00007FFDFB08A843, 00007FFDFB08A85F, 00007FFDFB08A8BB, 00007FFDFB08A8D7
o, xrefs: 00007FFDFB08A8CF

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: ..\s\crypto\bio\b_sock2.c$o
API String ID: 1729277954-1872632005
Opcode ID: 34993e59505dbed600dca64135d27a9ba0d4750b564e5c6ba914b5e12530ade6
Instruction ID: 5f171ad5f27b0b1a9da4b9df4d3dc2e1357ebc95c5a03c2dd06a7b903451eca6
Opcode Fuzzy Hash: 34993e59505dbed600dca64135d27a9ba0d4750b564e5c6ba914b5e12530ade6
Instruction Fuzzy Hash: DC51B331B4994386F320DB12E824AA97360FF86B58F444235E66847AEDCF3DE645DB00

Function 00007FFDFAFC3779 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 85stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB069E61
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDFB069E7C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB069F26

Strings

nombstr, xrefs: 00007FFDFB069E9F
default, xrefs: 00007FFDFB069F4A
MASK:, xrefs: 00007FFDFB069E5A
pkix, xrefs: 00007FFDFB069EDF
utf8only, xrefs: 00007FFDFB069F1C

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: strcmpstrncmpstrtoul
String ID: MASK:$default$nombstr$pkix$utf8only
API String ID: 1175158921-3483942737
Opcode ID: a21ae9ee1a6a80a1cd62bd08bae20b9b71c674710c0f9c2fb243c96c79f53681
Instruction ID: 439a3358cc4b6afae70233cd0f9bb4d440672c279676ba642b9034eb201fc354
Opcode Fuzzy Hash: a21ae9ee1a6a80a1cd62bd08bae20b9b71c674710c0f9c2fb243c96c79f53681
Instruction Fuzzy Hash: 69311A22B1958356EB414B18E460BB93791EB49750F445232E77E83AFDDE1CE594C700

Function 61B16B70 Relevance: 13.9, APIs: 3, Strings: 6, Instructions: 356stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 61B16D36

Strings

in != NULL, xrefs: 61B16CA7
8, xrefs: 61B17069
md != NULL, xrefs: 61B16C8E
MD5, xrefs: 61B16DC7
@, xrefs: 61B16CED
src/hashes/md5.c, xrefs: 61B16C87, 61B16CA0

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: strlen
String ID: 8$@$MD5$in != NULL$md != NULL$src/hashes/md5.c
API String ID: 39653677-1219784974
Opcode ID: 665fbba218407366f6e3c6b2172838b3794c219258130fd96b82cf4276d93d69
Instruction ID: cfc6f4735c9c242967f55884dc80c951e289ba4bfa0ef52b4be1aac614545c93
Opcode Fuzzy Hash: 665fbba218407366f6e3c6b2172838b3794c219258130fd96b82cf4276d93d69
Instruction Fuzzy Hash: 2ED113B360C3C18AF709DB5AE459B6EBF64E386388F568109DE820BB58D7BDC445CB41

Function 61B24EC0 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 61B24F33
malloc.MSVCRT ref: 61B24F3D

Strings

mask != NULL, xrefs: 61B25109
seed != NULL, xrefs: 61B250F0
src/pk/pkcs1/pkcs_1_mgf1.c, xrefs: 61B250E9, 61B25102

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: malloc
String ID: mask != NULL$seed != NULL$src/pk/pkcs1/pkcs_1_mgf1.c
API String ID: 2803490479-2931318352
Opcode ID: 6be74c4e40dc0d16bd1b16cdf17590bda24ac64160d98fa2262e4febbb8035bc
Instruction ID: 981eee45377077d7da0f3125a3915bc545afe5849467b799833808e2c521457b
Opcode Fuzzy Hash: 6be74c4e40dc0d16bd1b16cdf17590bda24ac64160d98fa2262e4febbb8035bc
Instruction Fuzzy Hash: 645104727091C446FB1ACB769904BBF6F61EB89B88F44C014CE694BA0DDB3AC409C744

Function 00007FF79967DC30 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF79967DC8D

Part of subcall function 00007FF79967EBA0: __GetUnwindTryBlock.LIBCMT ref: 00007FF79967EBE3
Part of subcall function 00007FF79967EBA0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF79967EC08

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF79967DD65
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF79967DFBA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF79967E0C6

Strings

csm, xrefs: 00007FF79967DD0E
csm, xrefs: 00007FF79967DCA7
csm, xrefs: 00007FF79967DD88

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction ID: a90bb8456953b4de09257b5f234b98d66b6a506c40b77641ebbfe4cacb03056d
Opcode Fuzzy Hash: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction Fuzzy Hash: DCE16A72A08B418AFB30AF3594502ADB7B2FB55798F900535EEAD57B95CF38E094C710

Function 00007FFDFAFC60D2 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

SwitchToFiber.KERNEL32 ref: 00007FFDFB083844
CreateFiber.KERNEL32 ref: 00007FFDFB0838BC
memmove.VCRUNTIME140 ref: 00007FFDFB083915
SwitchToFiber.KERNEL32 ref: 00007FFDFB083938
DeleteFiber.KERNEL32 ref: 00007FFDFB083A1B

Strings

*, xrefs: 00007FFDFB08377F
..\s\crypto\async\async.c, xrefs: 00007FFDFB083761, 00007FFDFB083778, 00007FFDFB0837C0, 00007FFDFB0838E9, 00007FFDFB083950, 00007FFDFB0839D0, 00007FFDFB083A06, 00007FFDFB083A27, 00007FFDFB083A54

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: Fiber$Switch$CreateDeletememmove
String ID: *$..\s\crypto\async\async.c
API String ID: 81049052-1471988776
Opcode ID: 1831d7c809a8188426ac0f01b2ae61a537539a6563a9100cc60af150d2942dba
Instruction ID: c2defc46d47df780fd0c1042655e703329d9dbfee787833c26fcd5323f0b47fb
Opcode Fuzzy Hash: 1831d7c809a8188426ac0f01b2ae61a537539a6563a9100cc60af150d2942dba
Instruction Fuzzy Hash: E6A16132B0AA4391EB24DF16E460A7973A0EF84B94F448031EAAD477E9DF3CE655D340

Function 00007FF79968DDB8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF79968E152,?,?,000001CA0EA26A98,00007FF79968A223,?,?,?,00007FF79968A11A,?,?,?,00007FF799685472), ref: 00007FF79968DF34
GetProcAddress.KERNEL32(?,00000000,?,00007FF79968E152,?,?,000001CA0EA26A98,00007FF79968A223,?,?,?,00007FF79968A11A,?,?,?,00007FF799685472), ref: 00007FF79968DF40

Strings

ext-ms-, xrefs: 00007FF79968DE91
api-ms-, xrefs: 00007FF79968DE7E

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction ID: f260d4db76f6b8784395444d1fd7ea88a066038ecdba909e45030ec7c15cfee3
Opcode Fuzzy Hash: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction Fuzzy Hash: D441CF21B1AA1283FA36AF279824575E2A3BF15BA0FC94135DD2D47B84DE3CF445C234

Function 00007FF799677600 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79967101D), ref: 00007FF79967769F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79967101D), ref: 00007FF7996776EF

Strings

win32_utils_to_utf8, xrefs: 00007FF799677728
Failed to encode wchar_t as UTF-8., xrefs: 00007FF799677718
WideCharToMultiByte, xrefs: 00007FF799677738
Out of memory., xrefs: 00007FF799677721
Failed to get UTF-8 buffer size., xrefs: 00007FF799677731

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: ff563fd808d69f35f83569dbbc19b7f1e21c5d08308d418d8919d0e7ff1619ab
Instruction ID: 0d5e00988aadbea750dcf7a87416e449d809141b83344e7ad1b7caf5271dac2d
Opcode Fuzzy Hash: ff563fd808d69f35f83569dbbc19b7f1e21c5d08308d418d8919d0e7ff1619ab
Instruction Fuzzy Hash: 69416D32A18B8282E630EF25B44016AF7FAFB84B94F984135DAAD47B94EF3CD451C710

Function 61B09340 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

PyUnicode_FromKindAndData.PYTHON39 ref: 61B09386
PyErr_SetString.PYTHON39 ref: 61B09DD7

Strings

EOF read where object expected, xrefs: 61B09DCA

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: DataErr_FromKindStringUnicode_
String ID: EOF read where object expected
API String ID: 3898585613-3634523442
Opcode ID: 70b6289a318af1f79354a926ed3fd527191c965d28a9e24e40a6bd2e9a010fc2
Instruction ID: 7ea5615932cfd93293a685b0e2784dfba877e7aa627470a910a87b624da84c9a
Opcode Fuzzy Hash: 70b6289a318af1f79354a926ed3fd527191c965d28a9e24e40a6bd2e9a010fc2
Instruction Fuzzy Hash: EC31D5722456D082EA1DCB25D49479E7BB5FB89B92F0ADA14CE0E077A4DF38D485CB40

Function 00007FFDFAEA48E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON39 ref: 00007FFDFAEA4919
_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA492F
PyErr_Occurred.PYTHON39 ref: 00007FFDFAEA49C9
PyLong_FromLong.PYTHON39 ref: 00007FFDFAEA49DA

Strings

combining, xrefs: 00007FFDFAEA4912
a unicode character, xrefs: 00007FFDFAEA4904
argument, xrefs: 00007FFDFAEA490B

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
String ID: a unicode character$argument$combining
API String ID: 3097524968-4202047184
Opcode ID: 9093699c94904b4bf7073e79ae722272963a5adc5b0dcf231abcba32b636913e
Instruction ID: b1f786d21855014778da3eb094e4ae83883efd691b20b80a40ccc25f58ad815a
Opcode Fuzzy Hash: 9093699c94904b4bf7073e79ae722272963a5adc5b0dcf231abcba32b636913e
Instruction Fuzzy Hash: 0731C0A1B0860782FB6C6B15D471B791291AF88B94F44C5B5CA6F4B3DDDE2EEC698300

Function 00007FFDFAEA5390 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON39 ref: 00007FFDFAEA53C9
_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA53DF
PyErr_Occurred.PYTHON39 ref: 00007FFDFAEA5479
PyLong_FromLong.PYTHON39 ref: 00007FFDFAEA548A

Strings

mirrored, xrefs: 00007FFDFAEA53C2
a unicode character, xrefs: 00007FFDFAEA53B4
argument, xrefs: 00007FFDFAEA53BB

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
String ID: a unicode character$argument$mirrored
API String ID: 3097524968-4001128513
Opcode ID: 54c05627f097f516bd39b4aff664f275978b312bea092729d04bd944666e477c
Instruction ID: 5c190fc9f737b32f389c288fb0f3aee479a31e3fec39056f5f830df39e313802
Opcode Fuzzy Hash: 54c05627f097f516bd39b4aff664f275978b312bea092729d04bd944666e477c
Instruction Fuzzy Hash: 1A31D1A1B4870682FB5C6B15C471B7D12A9AF86B95F4445B5CE2F4F3CCDE2EE8498320

Function 61B080F0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 61B08149
PyOS_string_to_double.PYTHON39 ref: 61B0815B
PyErr_SetString.PYTHON39 ref: 61B081B3

Strings

marshal data too short, xrefs: 61B081FC
EOF read where object expected, xrefs: 61B081A9

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_S_string_to_doubleStringmemcpy
String ID: EOF read where object expected$marshal data too short
API String ID: 1651926552-3827827332
Opcode ID: bf9f4db2a3f62d467a2a094e404d984d2fc0e9549e6c5f221707f412ea1bf879
Instruction ID: 3aed8a6ffb93bc12585ab7b0d785ebf2871035c410f82595333a81e2a8823fc0
Opcode Fuzzy Hash: bf9f4db2a3f62d467a2a094e404d984d2fc0e9549e6c5f221707f412ea1bf879
Instruction Fuzzy Hash: F031C332605A8484EF19DB6AE8103A93B66FB49FC9F48D621CE4D07764DF3DC6A6D340

Function 00007FF799677B40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF799673699), ref: 00007FF799677B81

Part of subcall function 00007FF799672620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF799677744,?,?,?,?,?,?,?,?,?,?,?,00007FF79967101D), ref: 00007FF799672654
Part of subcall function 00007FF799672620: MessageBoxW.USER32 ref: 00007FF79967272C

WideCharToMultiByte.KERNEL32(?,00007FF799673699), ref: 00007FF799677BF5

Strings

win32_utils_to_utf8, xrefs: 00007FF799677BC2
Failed to encode wchar_t as UTF-8., xrefs: 00007FF799677BFF
WideCharToMultiByte, xrefs: 00007FF799677B95, 00007FF799677C06
Out of memory., xrefs: 00007FF799677BBB
Failed to get UTF-8 buffer size., xrefs: 00007FF799677B8E

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: aced5f46d53ba3e30c592e5434d0d7ab1f54160dd14b943fd141642a19c75b6b
Instruction ID: c824078db04d8ba7a6d76ae15dbc936f5b6e84e1b63cf3fb44b90d23f7e5b2ea
Opcode Fuzzy Hash: aced5f46d53ba3e30c592e5434d0d7ab1f54160dd14b943fd141642a19c75b6b
Instruction Fuzzy Hash: C7217C71A09B4285FA20EF36A840079B6B7EB88B84FD84576CA6E43794EF7DE551C310

Function 61B08410 Relevance: 12.2, APIs: 8, Instructions: 242fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61B084BD

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: fwrite
String ID:
API String ID: 3559309478-0
Opcode ID: 300edc65d6d68ee49eaa891f1c63080a05e8db38e9573b5621298529621bec2d
Instruction ID: 61d6b6d4495842159ac51cd17e2ec84a8717696430867614510dbbc42ac9384d
Opcode Fuzzy Hash: 300edc65d6d68ee49eaa891f1c63080a05e8db38e9573b5621298529621bec2d
Instruction Fuzzy Hash: AD918CB6601B8085DB188FA9D54038D3BB5F709FE8F65861ADE6D17788DB39C2A1C380

Function 00007FFDFB1C23E0 Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 190stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00000000,00007FFDFB1C12F2), ref: 00007FFDFB1C2424
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1C2589

Strings

, status text: , xrefs: 00007FFDFB1C269C
..\s\crypto\ts\ts_rsp_verify.c, xrefs: 00007FFDFB1C24CD, 00007FFDFB1C24E7, 00007FFDFB1C2665, 00007FFDFB1C26C2
status code: , xrefs: 00007FFDFB1C26B0
unspecified, xrefs: 00007FFDFB1C2685
, failure codes: , xrefs: 00007FFDFB1C268C
unknown code, xrefs: 00007FFDFB1C244D

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: memsetstrncpy
String ID: , failure codes: $, status text: $..\s\crypto\ts\ts_rsp_verify.c$status code: $unknown code$unspecified
API String ID: 388311670-2553778726
Opcode ID: b75989da95301a0dee14cf80b734c7ea5b61b1f4cc6ed81891a073580cb8d314
Instruction ID: d7ab784f9ed2edeeebd54165b4999656a9c5863b7366b513bed4de0e0fd24f5c
Opcode Fuzzy Hash: b75989da95301a0dee14cf80b734c7ea5b61b1f4cc6ed81891a073580cb8d314
Instruction Fuzzy Hash: 1881B262F0E68386EB54EB12A460BFA63A0FF85B84F454135D96D877E9EF3CE5058300

Function 61B08F30 Relevance: 12.2, APIs: 8, Instructions: 169filestringCOMMON

Download Yara Rule

APIs

PyOS_double_to_string.PYTHON39 ref: 61B08F56
strlen.MSVCRT ref: 61B08F67
fwrite.MSVCRT ref: 61B08FFB
fwrite.MSVCRT ref: 61B09016

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: fwrite$S_double_to_stringstrlen
String ID:
API String ID: 4243900985-0
Opcode ID: 5b8df451a071cc43c3f45acaa98481a95b1c4222fc9fbf65292e85a38dbfafda
Instruction ID: 9117961313bfbcc205e9fcb3f68bcc85a9470d17a19ab38b84f8f34e3f580fc8
Opcode Fuzzy Hash: 5b8df451a071cc43c3f45acaa98481a95b1c4222fc9fbf65292e85a38dbfafda
Instruction Fuzzy Hash: 78517BA2301B8485DB09DF66E4543997BA1F789FE8F54862ADF5D07788EF38C195C380

Function 61B1F550 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 61B1F5C1
free.MSVCRT ref: 61B1F6BF

Strings

public_key_len != NULL, xrefs: 61B1F750
src/pk/asn1/der/sequence/der_decode_subject_public_key_info.c, xrefs: 61B1F749, 61B1F762, 61B1F77B
inlen != 0, xrefs: 61B1F769
in != NULL, xrefs: 61B1F782

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: callocfree
String ID: in != NULL$inlen != 0$public_key_len != NULL$src/pk/asn1/der/sequence/der_decode_subject_public_key_info.c
API String ID: 306872129-3913984646
Opcode ID: 13679105b8326c73b9dc7e70c9fc6e957bb7eccfce27270e8a4bd096e9eec400
Instruction ID: 869e3e91249f58171da8f8b3e739beb352b07a648235fd3bdabe15561be4e5b7
Opcode Fuzzy Hash: 13679105b8326c73b9dc7e70c9fc6e957bb7eccfce27270e8a4bd096e9eec400
Instruction Fuzzy Hash: EE41AC723096C18AEB748F66E8417CAB7A5F7C8788F448119DE9887B5CDB7DC149CB40

Function 61B0E6C0 Relevance: 12.1, APIs: 8, Instructions: 77COMMON

Download Yara Rule

APIs

_Py_fstat_noraise.PYTHON39 ref: 61B0E6DD
PyMem_Malloc.PYTHON39 ref: 61B0E706
PyList_New.PYTHON39 ref: 61B0E731
PyMem_Free.PYTHON39 ref: 61B0E763
fread.MSVCRT ref: 61B0E78E
PyMarshal_ReadObjectFromString.PYTHON39 ref: 61B0E799
PyMem_Free.PYTHON39 ref: 61B0E7A7

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Mem_$Free$FromList_MallocMarshal_ObjectPy_fstat_noraiseReadStringfread
String ID:
API String ID: 308550609-0
Opcode ID: 48fecd12bf7ae557e9bf8e45728714cbd4d82b5ee6fecf127a57dd09b6a9300f
Instruction ID: 6ce3c0cdb9ccdd22c00944b7eb84e6dbbc068b70a575d1812578659987ceeccb
Opcode Fuzzy Hash: 48fecd12bf7ae557e9bf8e45728714cbd4d82b5ee6fecf127a57dd09b6a9300f
Instruction Fuzzy Hash: 84219136605B8084EA198FA6F8443AEAB64EFC6FE9F084525EE4D47764DF3DC1958700

Function 00007FF799689264 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7996892A7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF799689694
_invalid_parameter_noinfo.LIBCMT ref: 00007FF799689930

Strings

p, xrefs: 00007FF7996893D1
f, xrefs: 00007FF7996893C9
p, xrefs: 00007FF799689359

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction ID: 1f1a71ee98f36a80f6aef0a51284f36c4e885c80b5c72fdfb15640155fd405a6
Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction Fuzzy Hash: 371271A2E0C143C6FB347E76D154279F6B2EB82756FC84435E7AA466C4DA3CE5818B20

Function 61B7D5E0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 61B7D68B

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 61B7D7B8
Address %p has no image-section, xrefs: 61B7D7C9
VirtualProtect failed with code 0x%x, xrefs: 61B7D76A

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 1804819252-2123141913
Opcode ID: c0f19d12fabfb822a7728595aa15563ede372f12539542be7abb64e78d43b425
Instruction ID: 402dc668226ab6243fac91901b84be13a457e3ae61b6c92f8299709a893104bd
Opcode Fuzzy Hash: c0f19d12fabfb822a7728595aa15563ede372f12539542be7abb64e78d43b425
Instruction Fuzzy Hash: DF518277741A8186EB258F66F84079D77B1F789BA8F49C615EE2D073A4EB39C542C300

Function 00007FFDFAFC54C5 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 121stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FFDFB1C6C9A
strchr.VCRUNTIME140 ref: 00007FFDFB1C6CAB
memmove.VCRUNTIME140 ref: 00007FFDFB1C6DCD

Strings

characters, xrefs: 00007FFDFB1C6D48
You must type in , xrefs: 00007FFDFB1C6D6F
to , xrefs: 00007FFDFB1C6D59
..\s\crypto\ui\ui_lib.c, xrefs: 00007FFDFB1C6D34, 00007FFDFB1C6DAD

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: strchr$memmove
String ID: characters$ to $..\s\crypto\ui\ui_lib.c$You must type in
API String ID: 1080442166-3422546668
Opcode ID: 058cebb37ec07b436eb0b80b8ced75f7358d0c981b7b5530fb3ba3095bcba817
Instruction ID: 31c2582a5be84a9a02e6c56ac92eb768229249ee91ed74406d0b0952f8a89422
Opcode Fuzzy Hash: 058cebb37ec07b436eb0b80b8ced75f7358d0c981b7b5530fb3ba3095bcba817
Instruction Fuzzy Hash: A8519162B0A64386EB228F25D820AB93760FF45B5CF044236EAAD476EDCF3CE515C740

Function 00007FFDFAEA16F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

PyUnicode_FromString.PYTHON39 ref: 00007FFDFAEA1817
_PyArg_BadArgument.PYTHON39 ref: 00007FFDFAEA3F1E
_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA3F2F

Strings

category, xrefs: 00007FFDFAEA3F17
a unicode character, xrefs: 00007FFDFAEA3F09
argument, xrefs: 00007FFDFAEA3F10

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Unicode_$Arg_ArgumentFromReadyString
String ID: a unicode character$argument$category
API String ID: 3000140846-2068800536
Opcode ID: 0294fef913222645426c0ce48ee816d9d182a10c09fc4bebf7c28f0d6c2e6e1a
Instruction ID: e8f3b814985c91414eb15412ca974b4bc391a5cd94f15eb5ef34c1bbc4e74983
Opcode Fuzzy Hash: 0294fef913222645426c0ce48ee816d9d182a10c09fc4bebf7c28f0d6c2e6e1a
Instruction Fuzzy Hash: 3E51E7A5B1864242EB1C9709D570AB962A2FF45B84F444175EA7F4F7D8DF3EE851C300

Function 00007FFDFAFC3CFC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 114stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FFDFB1B8369
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1B8384
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1B839D

Strings

T, xrefs: 00007FFDFB1B841A
..\s\crypto\store\store_lib.c, xrefs: 00007FFDFB1B83FB, 00007FFDFB1B8413
file, xrefs: 00007FFDFB1B8331, 00007FFDFB1B8376

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: _stricmpstrchrstrncmp
String ID: ..\s\crypto\store\store_lib.c$T$file
API String ID: 3017659097-909561481
Opcode ID: 28b18a60c300fbf15f045ff141a730ad0ac7c92fb26e074d972ddd8df418208a
Instruction ID: 433254ba6957a885f0c67b55d7f5676d97136836004e4bdb756639181f68ec3e
Opcode Fuzzy Hash: 28b18a60c300fbf15f045ff141a730ad0ac7c92fb26e074d972ddd8df418208a
Instruction Fuzzy Hash: E141A432B0AA4686E7159B12E460AA97390FF48F98F454135DE5D477A9EF3CD505C700

Function 00007FFDFAEA1000 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

PyUnicode_FromString.PYTHON39 ref: 00007FFDFAEA10DE
_PyArg_BadArgument.PYTHON39 ref: 00007FFDFAEA3BB0
_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA3BC0

Strings

bidirectional, xrefs: 00007FFDFAEA3BA9
a unicode character, xrefs: 00007FFDFAEA3B9B
argument, xrefs: 00007FFDFAEA3BA2

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Unicode_$Arg_ArgumentFromReadyString
String ID: a unicode character$argument$bidirectional
API String ID: 3000140846-2110215792
Opcode ID: 0f864afd84776e8862b990bff1841d7edc816d4c536149313772fa55c7a14bfa
Instruction ID: 5362c771098274ad1408fb5ccbcfac29f5ca2f2dfc484dcd4dc2b67040762f57
Opcode Fuzzy Hash: 0f864afd84776e8862b990bff1841d7edc816d4c536149313772fa55c7a14bfa
Instruction Fuzzy Hash: B041A4A2B0868382FB5C9B15D4B0B7922A2EF54B84F544575DA6F8F2D8DF2EEC44C300

Function 00007FF799677C30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF799677CC5
MultiByteToWideChar.KERNEL32 ref: 00007FF799677D07

Strings

Failed to get wchar_t buffer size., xrefs: 00007FF799677D46
win32_utils_from_utf8, xrefs: 00007FF799677D3D
Out of memory., xrefs: 00007FF799677D36
Failed to decode wchar_t from UTF-8, xrefs: 00007FF799677D2D
MultiByteToWideChar, xrefs: 00007FF799677D4D

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: 290b57ca8453ae885af3ff2fc0035437ec55c1325ab119fe22c2f927501d8716
Instruction ID: 8f214edc4514a6805941a47f19ed538f2d8c633251cbe1df22c28f565c6bc270
Opcode Fuzzy Hash: 290b57ca8453ae885af3ff2fc0035437ec55c1325ab119fe22c2f927501d8716
Instruction Fuzzy Hash: A2416B32A18B4282F630EF35A44017AA7BAFB48B94F945135DAAD47BA4EF3CD452C710

Function 00007FFDFAEA56B4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

_PyUnicode_EqualToASCIIId.PYTHON39 ref: 00007FFDFAEA56E8

Strings

invalid normalization form, xrefs: 00007FFDFAEA57FD

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: EqualUnicode_
String ID: invalid normalization form
API String ID: 3822945493-2281882113
Opcode ID: 27a683614d972d0201c07423aad88ca84f1c66f1d627d019b31ed67477571f71
Instruction ID: 6a5322d5ad8ed90fcde9829f41e2f497363d82a4be119455ca78fffdfeea528f
Opcode Fuzzy Hash: 27a683614d972d0201c07423aad88ca84f1c66f1d627d019b31ed67477571f71
Instruction Fuzzy Hash: 1E318095B0C24281FB58A7269934F795295AF86FC4F5481B1ED2F8EACDDF2EE0058720

Function 00007FFDFAFC2E46 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FFDFB0CDA12

Strings

~, xrefs: 00007FFDFB0CDA47
OPENSSL_ia32cap, xrefs: 00007FFDFB0CD9E8
~, xrefs: 00007FFDFB0CDA2C
~, xrefs: 00007FFDFB0CDAC4
~, xrefs: 00007FFDFB0CDADC

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: EnvironmentVariable
String ID: OPENSSL_ia32cap$~$~$~$~
API String ID: 1431749950-1981414212
Opcode ID: f54770ac84b8c5300f15358e4cffcff24408fff1c96f1f72ed2546603f76ac2f
Instruction ID: eb280fabfc360328e6087c4f096e433602978690e84c591348b56caad08b9644
Opcode Fuzzy Hash: f54770ac84b8c5300f15358e4cffcff24408fff1c96f1f72ed2546603f76ac2f
Instruction Fuzzy Hash: 1C419F65F1E61786E7149B02A8709B862A0EF46790F844276E97D8B6FCEF3CE481D700

Function 00007FFDFAEA4A2C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON39 ref: 00007FFDFAEA4A67
_PyArg_BadArgument.PYTHON39 ref: 00007FFDFAEA4A9C
_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA4AB0

Strings

a unicode character, xrefs: 00007FFDFAEA4A87
argument 1, xrefs: 00007FFDFAEA4A95
decimal, xrefs: 00007FFDFAEA4A60, 00007FFDFAEA4A8E

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$decimal
API String ID: 3545102714-2474051849
Opcode ID: a666c7166e4bacd0b890e9221d416e98014b4c622d339b4779f80b6bec25da52
Instruction ID: 9bafa4c0b6a1189bc17650317bd788a4907de47cd84f681353defcf37da63a4d
Opcode Fuzzy Hash: a666c7166e4bacd0b890e9221d416e98014b4c622d339b4779f80b6bec25da52
Instruction Fuzzy Hash: DD31A6A2B1864681EB586B05D460B7963A1EB84B84F544071DE2E4B7DCDF3FE85AC304

Function 00007FFDFAEA5820 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON39 ref: 00007FFDFAEA585B
_PyArg_BadArgument.PYTHON39 ref: 00007FFDFAEA5890
_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA58A4

Strings

a unicode character, xrefs: 00007FFDFAEA587B
numeric, xrefs: 00007FFDFAEA5854, 00007FFDFAEA5882
argument 1, xrefs: 00007FFDFAEA5889

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$numeric
API String ID: 3545102714-2385192657
Opcode ID: b6081668707e201990f47e5f17aa36e2215835f861d98285af28329eaceb8570
Instruction ID: be67e94769197f36cd4a7b837c8562023f1f1d4127c9570a445863e3ad202339
Opcode Fuzzy Hash: b6081668707e201990f47e5f17aa36e2215835f861d98285af28329eaceb8570
Instruction Fuzzy Hash: 4031A0A1B0864681EB58AB06D460A792365EB86BA4F548075DE3E4F7DCDF3EE846C310

Function 00007FFDFAEA54E8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON39 ref: 00007FFDFAEA5523
_PyArg_BadArgument.PYTHON39 ref: 00007FFDFAEA5558
_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA556C

Strings

name, xrefs: 00007FFDFAEA551C, 00007FFDFAEA554A
a unicode character, xrefs: 00007FFDFAEA5543
argument 1, xrefs: 00007FFDFAEA5551

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$name
API String ID: 3545102714-4190364640
Opcode ID: a9aa13617e7f9f24179f50e5bf1d758422cc585441daa19b1ee8822838b25842
Instruction ID: 56b7e5e205da1a0e18ac6e00a4ac0a5b3936e157315d33f77a592069759b1b89
Opcode Fuzzy Hash: a9aa13617e7f9f24179f50e5bf1d758422cc585441daa19b1ee8822838b25842
Instruction Fuzzy Hash: 6A31A5A1B08B4581EB58AB15D4607792366EF86B94F948071CE2E4B7DCDF3FE842C710

Function 00007FF799676480 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF799677A30: MultiByteToWideChar.KERNEL32 ref: 00007FF799677A6A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7996767CF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF7996764DF

Part of subcall function 00007FF799672770: MessageBoxW.USER32 ref: 00007FF799672841

Strings

LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF79967653A
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7996764B6
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7996764F3

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: e82e75a9301f2c01be817318613aadd6cb56ce3046e43f6970fb0f78f3b425c1
Instruction ID: 266ed820efb383508b0c9beb70bef48630d694d6329b3ef92696a695b2a67dbb
Opcode Fuzzy Hash: e82e75a9301f2c01be817318613aadd6cb56ce3046e43f6970fb0f78f3b425c1
Instruction Fuzzy Hash: 19316911B1974291FA30BF31A9553BAD6B3AF987C0FC44031DA6E827DAEE2CE5048720

Function 00007FF79967CEE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF79967D19A,?,?,?,00007FF79967CE8C,?,?,00000001,00007FF79967CAA9), ref: 00007FF79967CF6D
GetLastError.KERNEL32(?,?,?,00007FF79967D19A,?,?,?,00007FF79967CE8C,?,?,00000001,00007FF79967CAA9), ref: 00007FF79967CF7B
LoadLibraryExW.KERNEL32(?,?,?,00007FF79967D19A,?,?,?,00007FF79967CE8C,?,?,00000001,00007FF79967CAA9), ref: 00007FF79967CFA5
FreeLibrary.KERNEL32(?,?,?,00007FF79967D19A,?,?,?,00007FF79967CE8C,?,?,00000001,00007FF79967CAA9), ref: 00007FF79967CFEB
GetProcAddress.KERNEL32(?,?,?,00007FF79967D19A,?,?,?,00007FF79967CE8C,?,?,00000001,00007FF79967CAA9), ref: 00007FF79967CFF7

Strings

api-ms-, xrefs: 00007FF79967CF8D

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction ID: 4c21afe2fbe12589a4483beb81a974cddd8ac0454b33f17811cba323b8c94d9c
Opcode Fuzzy Hash: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction Fuzzy Hash: 6E31B021A1AB4296FE71AF22A400575A3F6FF08BA4F994935DD3D4A390DF3CE445C720

Function 00007FFDFAEA4E48 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON39 ref: 00007FFDFAEA4E7B
_PyArg_BadArgument.PYTHON39 ref: 00007FFDFAEA4EB0
_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA4EC4

Strings

a unicode character, xrefs: 00007FFDFAEA4E9B
digit, xrefs: 00007FFDFAEA4E74, 00007FFDFAEA4EA2
argument 1, xrefs: 00007FFDFAEA4EA9

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$digit
API String ID: 3545102714-197099943
Opcode ID: 99a2ae79ef103e32a17fd28209526f7767674ae648d8c372e55bf47f1399ef43
Instruction ID: 30812bb1aac1eb627640524605cfc97b081de89911d8c2d8be90768905e296c4
Opcode Fuzzy Hash: 99a2ae79ef103e32a17fd28209526f7767674ae648d8c372e55bf47f1399ef43
Instruction Fuzzy Hash: 9E31B3B5B1864681FB58AB15D460A792351EB80B84F55A0B1DA3E4F7DCDF3EE84AC300

Function 61B091F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON39 ref: 61B092C4

Strings

recursion limit exceeded, xrefs: 61B099EE
bad marshal data (unknown type code), xrefs: 61B099C7
EOF read where object expected, xrefs: 61B092B7

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_String
String ID: EOF read where object expected$bad marshal data (unknown type code)$recursion limit exceeded
API String ID: 1450464846-1585441539
Opcode ID: 53f80a7f334273c1597f2343aa5bb58d35803aa02bf71835f72046ffe268b2e0
Instruction ID: 9bacff15ff5468acc3aa1adf18385717b84df7f582190d71c43ce57c7443de44
Opcode Fuzzy Hash: 53f80a7f334273c1597f2343aa5bb58d35803aa02bf71835f72046ffe268b2e0
Instruction Fuzzy Hash: DF31A332204AC5C1EB1A8B19D8417ED7BB5FB85B59F49D511DE4D073A4EF39C496C300

Function 00007FFDFAEA4CE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

PyUnicode_FromString.PYTHON39 ref: 00007FFDFAEA4D25
memcpy.VCRUNTIME140 ref: 00007FFDFAEA4DA9
PyOS_snprintf.PYTHON39 ref: 00007FFDFAEA4DEB
PyUnicode_FromStringAndSize.PYTHON39 ref: 00007FFDFAEA4E18

Strings

, xrefs: 00007FFDFAEA4DC1
%04X, xrefs: 00007FFDFAEA4DD6

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: FromStringUnicode_$S_snprintfSizememcpy
String ID: $%04X
API String ID: 3253253298-4013080060
Opcode ID: 4d44ecb2a9b93b4644e1663977b58a083ffdcee3f43ff71f62f85fb0096faf9c
Instruction ID: cf7d46da3f2f6d13610d4d411e5497cb72baf2b783448569f736452d59db5dee
Opcode Fuzzy Hash: 4d44ecb2a9b93b4644e1663977b58a083ffdcee3f43ff71f62f85fb0096faf9c
Instruction Fuzzy Hash: 2831D2B2B18A8141EB299B14E4207F967A0FB45B64F440374DA7E0B7D8CF3DE549C300

Function 00007FFDFAFC39B8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74fileCOMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FFDFB18E3F9
_chmod.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FFDFB18E4BD
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFB18E4D6
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFB18E4E2

Strings

..\s\crypto\rand\randfile.c, xrefs: 00007FFDFB18E41C, 00007FFDFB18E480
Filename=, xrefs: 00007FFDFB18E432, 00007FFDFB18E4A1

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: _chmod_stat64i32fclosefwrite
String ID: ..\s\crypto\rand\randfile.c$Filename=
API String ID: 4260490851-2201148535
Opcode ID: ffb6a3000f1f43db175e07ee08783f9f81d8d84b3e7221bb60cce5b0c7cc5f2d
Instruction ID: f20d3a6b4ed46e6f01640e7d44f69e26467e6e8f7d86201d03175e93847a5572
Opcode Fuzzy Hash: ffb6a3000f1f43db175e07ee08783f9f81d8d84b3e7221bb60cce5b0c7cc5f2d
Instruction Fuzzy Hash: F231CF62B0E64792E714EB16E464AA96350FF85B88F404131EA6D4BBEDDF3CE604C704

Function 00007FF799677A30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF799677A6A

Part of subcall function 00007FF799672620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF799677744,?,?,?,?,?,?,?,?,?,?,?,00007FF79967101D), ref: 00007FF799672654
Part of subcall function 00007FF799672620: MessageBoxW.USER32 ref: 00007FF79967272C

MultiByteToWideChar.KERNEL32 ref: 00007FF799677AF0

Strings

Failed to get wchar_t buffer size., xrefs: 00007FF799677A77
win32_utils_from_utf8, xrefs: 00007FF799677AB9
Out of memory., xrefs: 00007FF799677AB2
Failed to decode wchar_t from UTF-8, xrefs: 00007FF799677AFA
MultiByteToWideChar, xrefs: 00007FF799677A7E, 00007FF799677B01

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: a067ef3949ab1c43b8cad70a8c207a907739284b21da8d2c9820fdf83144c31f
Instruction ID: 4a75324088f6c00c57e3098ae5e7121ca9c913d2835dcd07ebb7702587889bf3
Opcode Fuzzy Hash: a067ef3949ab1c43b8cad70a8c207a907739284b21da8d2c9820fdf83144c31f
Instruction Fuzzy Hash: FA213222B18A4281FA60EF35F400069E3B2EF85784F944572DB6C83B69EF2DD5418710

Function 00007FF79968A620 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F,?,?,?,00007FF799689313), ref: 00007FF79968A62F
FlsGetValue.KERNEL32(?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F,?,?,?,00007FF799689313), ref: 00007FF79968A644
FlsSetValue.KERNEL32(?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F,?,?,?,00007FF799689313), ref: 00007FF79968A665
FlsSetValue.KERNEL32(?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F,?,?,?,00007FF799689313), ref: 00007FF79968A692
FlsSetValue.KERNEL32(?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F,?,?,?,00007FF799689313), ref: 00007FF79968A6A3
FlsSetValue.KERNEL32(?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F,?,?,?,00007FF799689313), ref: 00007FF79968A6B4
SetLastError.KERNEL32(?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F,?,?,?,00007FF799689313), ref: 00007FF79968A6CF

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 8ff2e8f234801333ca104f51e052509623115d46483bc0ab35df31335539f603
Instruction ID: 73d80ed725b09cdc29989f16e4ca3e2d422295f8e366a04a994ffe3a41db0764
Opcode Fuzzy Hash: 8ff2e8f234801333ca104f51e052509623115d46483bc0ab35df31335539f603
Instruction Fuzzy Hash: 9A213A70A0D202C2FA79BF725655139E2735F55BA0F940734D97E076DAEE2CB4414220

Function 61B096E1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON39 ref: 61B096EC
PyBytes_FromStringAndSize.PYTHON39 ref: 61B09E54
memcpy.MSVCRT ref: 61B09E91

Strings

bad marshal data (bytes object size out of range), xrefs: 61B0A3C3

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Bytes_Err_FromOccurredSizeStringmemcpy
String ID: bad marshal data (bytes object size out of range)
API String ID: 2675459810-66224825
Opcode ID: 92c5b1a0b88adb179ce1d16a41b8aef37eea56c3925c4fd81cf8151255289d23
Instruction ID: d7f6701de36fa4591aac1905f8b82d02cd5df80960f2d598847556aa05fd7fcb
Opcode Fuzzy Hash: 92c5b1a0b88adb179ce1d16a41b8aef37eea56c3925c4fd81cf8151255289d23
Instruction Fuzzy Hash: CD114C313466D082EA1CDF26D494B9E7B66FB85B82F0AE914CE4E47354DF38D885CB80

Function 61B105D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON39 ref: 61B105FD
_Py_Dealloc.PYTHON39 ref: 61B10613
PyNumber_Positive.PYTHON39 ref: 61B10624
PyNumber_Invert.PYTHON39 ref: 61B10630
PyNumber_Negative.PYTHON39 ref: 61B10640

Strings

Invalid operator, xrefs: 61B105F3

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Number_$DeallocErr_InvertNegativePositiveString
String ID: Invalid operator
API String ID: 4031754375-2676212410
Opcode ID: e43d0ac3a2896a2f67a600cd6766564b3cbe55af0361f6eadad9ab3038d34fd0
Instruction ID: 325188d79402b833f1e0c4fe39ff6b8c10fe0be5028896ba3e4c7a19bb3eea30
Opcode Fuzzy Hash: e43d0ac3a2896a2f67a600cd6766564b3cbe55af0361f6eadad9ab3038d34fd0
Instruction Fuzzy Hash: B3F06D31259984D0FB184B7AE84636D3772E7CAB48F6E9D11EA198223CDF39C0B58601

Function 61B7E7B0 Relevance: 9.1, APIs: 6, Instructions: 137stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 61B7E7CD
_stat64.MSVCRT ref: 61B7E81B
malloc.MSVCRT ref: 61B7E933
memcpy.MSVCRT ref: 61B7E948
_stat64.MSVCRT ref: 61B7E95B
free.MSVCRT ref: 61B7E970

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: _stat64$freemallocmemcpystrlen
String ID:
API String ID: 4289191721-0
Opcode ID: 8414e5a3a7e4052aa9e9f449211b4d820bdd3805a5f9a4e46ec3ea4d71fd43f6
Instruction ID: 6608ce95a6f936637fc42595c3cc74cd579b9565d2d2504914a6ebd053dc289f
Opcode Fuzzy Hash: 8414e5a3a7e4052aa9e9f449211b4d820bdd3805a5f9a4e46ec3ea4d71fd43f6
Instruction Fuzzy Hash: 9A5190625096D089EB788B63D0803EEBBA2EF85B98F44C516EAB40B758D73EC145C751

Function 00007FFDFAFC648D Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1F3A98
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1F3B06
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1F3B31

Strings

DER:, xrefs: 00007FFDFB1F3AF9
ASN1:, xrefs: 00007FFDFB1F3B24
critical,, xrefs: 00007FFDFB1F3A91

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: strncmp
String ID: ASN1:$DER:$critical,
API String ID: 1114863663-369496153
Opcode ID: ddb8bcea3cefd020a4e8a34bae29a66c7c6434e734eea52e0975a0b147bfa819
Instruction ID: f60e503ef5eaa3a1f75767b97e8dbfd30a1b96a8de8fcaeefaa4d2f6d33ee2f4
Opcode Fuzzy Hash: ddb8bcea3cefd020a4e8a34bae29a66c7c6434e734eea52e0975a0b147bfa819
Instruction Fuzzy Hash: E441AF22F096D702FB149B22A830B7A2A80AF05BD8F084131DD6E8B7EDDE3CE515C744

Function 00007FFDFAFC4DF4 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1F35B7

Strings

DER:, xrefs: 00007FFDFB1F3619
ASN1:, xrefs: 00007FFDFB1F3644
critical,, xrefs: 00007FFDFB1F35B0

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: strncmp
String ID: ASN1:$DER:$critical,
API String ID: 1114863663-369496153
Opcode ID: 9dcb5025aebed33bc3ac4bc51b42553d44f8733820fabb1b2b7665fe447d2112
Instruction ID: 12185e1854dd29369d20f83c6090cf56172c63062e4281c28f6250140e05aa60
Opcode Fuzzy Hash: 9dcb5025aebed33bc3ac4bc51b42553d44f8733820fabb1b2b7665fe447d2112
Instruction Fuzzy Hash: 6C41C422F19A8742EB109F26B820B796A90AF45BE8F445131DD6E4B7EDDE3CE505C740

Function 61B0FB90 Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

PyEval_GetGlobals.PYTHON39 ref: 61B0FBA1
PyDict_SetItem.PYTHON39 ref: 61B0FC19
PyDict_GetItem.PYTHON39 ref: 61B0FC3D
PyDict_DelItem.PYTHON39 ref: 61B0FC56

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Dict_Item$Eval_Globals
String ID:
API String ID: 298195719-0
Opcode ID: f62a9e3b3299bc08e21e27f3257cdaa17620d9df9586d3163e61a32df8beaeea
Instruction ID: 70b714899b52638c211c220f5537ed9612e635a594e4ffc4b7058de84f6c8323
Opcode Fuzzy Hash: f62a9e3b3299bc08e21e27f3257cdaa17620d9df9586d3163e61a32df8beaeea
Instruction Fuzzy Hash: AE119162F4669583FD1EA7967C553850952FB89FD6F4DC829CD0D46314EE28C8C38214

Function 61B0F4E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

exit.MSVCRT ref: 61B0F4E9
VirtualAlloc.KERNEL32 ref: 61B0F60B
memcpy.MSVCRT ref: 61B0F62B

Strings

Failed to alloc memory for spp code, xrefs: 61B0F72B

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: AllocVirtualexitmemcpy
String ID: Failed to alloc memory for spp code
API String ID: 693558432-822294455
Opcode ID: 2ac448e7bc59e173728e6f02294bee066b1d6f39c3e502552832df68f249fe3e
Instruction ID: 20d93659b06e9d31499606b68eedc43e3ae5ba7fd23a457fdf669a5c45302ae1
Opcode Fuzzy Hash: 2ac448e7bc59e173728e6f02294bee066b1d6f39c3e502552832df68f249fe3e
Instruction Fuzzy Hash: 68518CB2702B8482EF598F56E8807587BA9FB48FD5F49812AEE5C477A4EB38C051C304

Function 00007FFDFB087060 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FFDFB086813), ref: 00007FFDFB0870AD
getnameinfo.WS2_32 ref: 00007FFDFB0870FB
htons.WS2_32 ref: 00007FFDFB08716B

Strings

..\s\crypto\bio\b_addr.c, xrefs: 00007FFDFB087114, 00007FFDFB087196, 00007FFDFB0871B5, 00007FFDFB0871E5, 00007FFDFB087202, 00007FFDFB087224
, xrefs: 00007FFDFB0870E1

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: getnameinfohtonsmemset
String ID: $..\s\crypto\bio\b_addr.c
API String ID: 165288700-1606403076
Opcode ID: d2f848d746c8b10697f0348c3f562ec89d997c7dadc394e330dc32da209875ca
Instruction ID: 03e1868b6d1e84d34c45e3ffffde75420639403bcfe44533c6c76b68d195f6f0
Opcode Fuzzy Hash: d2f848d746c8b10697f0348c3f562ec89d997c7dadc394e330dc32da209875ca
Instruction Fuzzy Hash: 0751C421B4AA4382FB259F15D420AB973A0EF41744F448131EAAD4BAFDEF3DE6859700

Function 00007FF799672240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF79967242F), ref: 00007FF799672278
DialogBoxIndirectParamW.USER32 ref: 00007FF79967233C
DeleteObject.GDI32 ref: 00007FF79967236F
DestroyIcon.USER32 ref: 00007FF799672381

Strings

Unhandled exception in script, xrefs: 00007FF7996722A8

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 01a0bb9e98a22bc39d92f1d9306349b6b95e7735addeeef39cbdf51254e5f23a
Instruction ID: 4aad9533128c2b7fd2fa26b7d8d5e179ec7ec655d1878852b9112b5b5da526f0
Opcode Fuzzy Hash: 01a0bb9e98a22bc39d92f1d9306349b6b95e7735addeeef39cbdf51254e5f23a
Instruction Fuzzy Hash: 13311826A09A8289EB24EF71E8552F9A3B2FF88794F800135EA5D4BB59DF3CD1458710

Function 00007FFDFAEA4BF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON39 ref: 00007FFDFAEA4C29
_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA4C3F

Strings

a unicode character, xrefs: 00007FFDFAEA4C14
argument, xrefs: 00007FFDFAEA4C1B
decomposition, xrefs: 00007FFDFAEA4C22

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Arg_ArgumentReadyUnicode_
String ID: a unicode character$argument$decomposition
API String ID: 1875788646-2471543666
Opcode ID: fb6dfd9ffdaf49ba4140d54d3d32b68e5125e30204456a752431b77ad20806da
Instruction ID: 85e9ed2eab4ee6adc9d3b1672fc4c0a9ff4b63cf1a616e8e3e23dd31ca2dc4aa
Opcode Fuzzy Hash: fb6dfd9ffdaf49ba4140d54d3d32b68e5125e30204456a752431b77ad20806da
Instruction Fuzzy Hash: F72190E1B0860A82FB6CAB25D571B791291AF84B94F544575CF2F4F3C8DF2EE8499340

Function 00007FFDFAEA4FD0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON39 ref: 00007FFDFAEA5009
_PyUnicode_Ready.PYTHON39 ref: 00007FFDFAEA501F

Strings

a unicode character, xrefs: 00007FFDFAEA4FF4
east_asian_width, xrefs: 00007FFDFAEA5002
argument, xrefs: 00007FFDFAEA4FFB

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Arg_ArgumentReadyUnicode_
String ID: a unicode character$argument$east_asian_width
API String ID: 1875788646-3913127203
Opcode ID: 3049eb6223301432bab1d64342742326a33489a89824b1eb66d711c2c6d325e9
Instruction ID: 043c623f5da99849a228451fb01eb0f98b2e445679d6e5f56b88364ce20fd7d6
Opcode Fuzzy Hash: 3049eb6223301432bab1d64342742326a33489a89824b1eb66d711c2c6d325e9
Instruction Fuzzy Hash: 6021D1A1B0860682FB5C5B15C8B1B7922959F86B94F444475DF2F4F3C8DE2FE8458390

Function 00007FF799672620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF799677744,?,?,?,?,?,?,?,?,?,?,?,00007FF79967101D), ref: 00007FF799672654

Part of subcall function 00007FF7996774B0: GetLastError.KERNEL32(00000000,00007FF7996726A0), ref: 00007FF7996774D7
Part of subcall function 00007FF7996774B0: FormatMessageW.KERNEL32(00000000,00007FF7996726A0), ref: 00007FF799677506

Part of subcall function 00007FF799677A30: MultiByteToWideChar.KERNEL32 ref: 00007FF799677A6A

MessageBoxW.USER32 ref: 00007FF79967272C
MessageBoxA.USER32 ref: 00007FF799672748

Strings

%s%s: %s, xrefs: 00007FF7996726AD
Fatal error detected, xrefs: 00007FF799672700, 00007FF79967273A

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction ID: 4966ea3d39accd05bf1668c54926c908baa1c8b0c422090da719c9a7e6978903
Opcode Fuzzy Hash: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction Fuzzy Hash: 7E31217662878291F630AF20E4517EAA3B6FB84784FC04036E69D47B99DF3CD245CB50

Function 61B10225 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON39 ref: 61B10214
PyErr_GivenExceptionMatches.PYTHON39 ref: 61B10256
PyTuple_Size.PYTHON39 ref: 61B10303
PyErr_SetString.PYTHON39 ref: 61B10371

Strings

catching classes that do not inherit from BaseException is not allowed, xrefs: 61B10365

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$DeallocExceptionGivenMatchesSizeStringTuple_
String ID: catching classes that do not inherit from BaseException is not allowed
API String ID: 1667255942-1287988286
Opcode ID: c0edb2aee330522def09da44b1c3de2a248a472726f822d0e0e333713dea02a3
Instruction ID: c22ac20c31a8a0bc089cfa0a8b133bc4d09fa1b7058dd088e8d0d7bee924291a
Opcode Fuzzy Hash: c0edb2aee330522def09da44b1c3de2a248a472726f822d0e0e333713dea02a3
Instruction Fuzzy Hash: 40215B7270978486EB0D8B56E58639A3B61F747F88F09D425CE4D97368DF2AC0A5C341

Function 00007FFDFAEA1EC0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON39(?,?,?,?,?,00007FFDFAEA1EAC), ref: 00007FFDFAEA4187

Part of subcall function 00007FFDFAEA1F40: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAEA1F78
Part of subcall function 00007FFDFAEA1F40: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAEA1F96

PyErr_Format.PYTHON39 ref: 00007FFDFAEA1F27
PyUnicode_FromKindAndData.PYTHON39 ref: 00007FFDFAEA41B6

Strings

name too long, xrefs: 00007FFDFAEA417D
undefined character name '%s', xrefs: 00007FFDFAEA1F1A

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: Err_strncmp$DataFormatFromKindStringUnicode_
String ID: name too long$undefined character name '%s'
API String ID: 2291325159-4056717002
Opcode ID: 4d3d9bbcfcb2b76ebef15fb2bf955f31dbf4cc68b858e63a76568d921ffed92d
Instruction ID: 95353f99f2bbdbe345e368e4b5459dbff868f24e0f4dc6955ecfab7ca179b8bf
Opcode Fuzzy Hash: 4d3d9bbcfcb2b76ebef15fb2bf955f31dbf4cc68b858e63a76568d921ffed92d
Instruction Fuzzy Hash: 7A1151B5B0894781EB08EB18D464AB86360FF99B58F8000B1C62F4F2E9DF7ED14AC750

Function 61B107B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON39 ref: 61B107B7
PyErr_Format.PYTHON39 ref: 61B107E6
PyErr_Format.PYTHON39 ref: 61B10805

Strings

local variable referenced before assignment, xrefs: 61B107FB
No active exception to reraise, xrefs: 61B107DC

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$Format$Occurred
String ID: No active exception to reraise$local variable referenced before assignment
API String ID: 1084603930-1116140797
Opcode ID: 3cc3c2ca48d362c8093ac4985812ca72e8df5d8ef321c9e6ef8b2d79a8f9db33
Instruction ID: 17232e05a26c6c8839bcffa24af84de3b83d5e1ebf4379455c944f0555420e48
Opcode Fuzzy Hash: 3cc3c2ca48d362c8093ac4985812ca72e8df5d8ef321c9e6ef8b2d79a8f9db33
Instruction Fuzzy Hash: 91F05E7170574A91FE049B76E9C138813A6EB49B60F496811C91A8B224CF6EC0FA8710

Function 00007FFDFAFC1064 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB1D14BF
memmove.VCRUNTIME140 ref: 00007FFDFB1D16A5

Strings

NO X509_NAME, xrefs: 00007FFDFB1D14B2
..\s\crypto\x509\x509_obj.c, xrefs: 00007FFDFB1D14A0, 00007FFDFB1D176F, 00007FFDFB1D1793
0123456789ABCDEF, xrefs: 00007FFDFB1D16C4

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: memmovestrncpy
String ID: ..\s\crypto\x509\x509_obj.c$0123456789ABCDEF$NO X509_NAME
API String ID: 3054264757-3422593365
Opcode ID: 9b9efaebcae82d5b25afce34890e7de1e927facac3b25ebeea1ebe1cac246e78
Instruction ID: 43414239b1c510a8763a1c9e90be5011f7441ca45df1fdff6d2a88bc53b971d9
Opcode Fuzzy Hash: 9b9efaebcae82d5b25afce34890e7de1e927facac3b25ebeea1ebe1cac246e78
Instruction Fuzzy Hash: 28B1E323F0A68385FB148B569460B7AB790FF89798F084135EA6E477E9DF7CE4518700

Function 00007FFDFAFC1762 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 203COMMON

Download Yara Rule

Strings

$, xrefs: 00007FFDFB19FBA3
..\s\crypto\rsa\rsa_sign.c, xrefs: 00007FFDFB19FA9D, 00007FFDFB19FAD0, 00007FFDFB19FAE7, 00007FFDFB19FB5B, 00007FFDFB19FBB5, 00007FFDFB19FD3A, 00007FFDFB19FD57

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID:
String ID: $$..\s\crypto\rsa\rsa_sign.c
API String ID: 0-1864662394
Opcode ID: 5be8950669065cf38b90a0ebdc6f30fdb2fef65e54fc5a44b632af0f9284c8ab
Instruction ID: a6b7dc55e773c6c8f7e5e62bee955dddba41d39deac4ace22f96e2befdcfccd9
Opcode Fuzzy Hash: 5be8950669065cf38b90a0ebdc6f30fdb2fef65e54fc5a44b632af0f9284c8ab
Instruction Fuzzy Hash: 5B918962F0A6C396E7249E12A060BA96790FB44B8CF408131EAAD47BEDDF7CF545C700

Function 00007FFDFAFC1ED3 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFDFB173021

Strings

..\s\crypto\pem\pem_lib.c, xrefs: 00007FFDFB17306A, 00007FFDFB1730D3, 00007FFDFB1731BC
;, xrefs: 00007FFDFB173062
Enter PEM pass phrase:, xrefs: 00007FFDFB173037

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: memmove
String ID: ..\s\crypto\pem\pem_lib.c$;$Enter PEM pass phrase:
API String ID: 2162964266-3733131234
Opcode ID: bdc686fb8aba523b28e55b03942bb12ed9c37acd52b0f3eb95ac45e93db571c2
Instruction ID: 13d0a2dad9709f1e1793d47f41e4608bfda93b8edc9190af1f7577114bed29ea
Opcode Fuzzy Hash: bdc686fb8aba523b28e55b03942bb12ed9c37acd52b0f3eb95ac45e93db571c2
Instruction Fuzzy Hash: 84719362B0968386E720DB22F460BAA7390FF94798F550235EAAD47ADDDF3CD501CB04

Function 61B12620 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 61B126D6
sprintf.MSVCRT ref: 61B12700

Strings

../src/platforms/windows/hdinfo.c, xrefs: 61B1274C
/%d:, xrefs: 61B126AB, 61B126BD
No any serial number of harddisk got, xrefs: 61B12745

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: sprintfstrlen
String ID: ../src/platforms/windows/hdinfo.c$/%d:$No any serial number of harddisk got
API String ID: 1090396089-4267867539
Opcode ID: a6e5ac065751269d4065104fe785992f9fab6ea796f1317f4210fb337939e264
Instruction ID: f92cae88e382bc2665ad6c041e7191a53b5088152c47a17280cd8c4ae3a68ae3
Opcode Fuzzy Hash: a6e5ac065751269d4065104fe785992f9fab6ea796f1317f4210fb337939e264
Instruction Fuzzy Hash: 67317F53B0D4C049EE198A79AC513DD2613E787BE4FADC6A1DD25876CCDB3989C6C300

Function 61B11590 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

PyFunction_NewWithQualName.PYTHON39 ref: 61B115DC
_Py_Dealloc.PYTHON39 ref: 61B11667

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: DeallocFunction_NameQualWith
String ID:
API String ID: 2691592392-0
Opcode ID: b927ae74619758a598cfc9270831e4a31ed0d6aa4f6bb5add9ed4790784cb533
Instruction ID: f72ec1ecf6ad03a4ae1ffde0be64eb248f86ae5d2219c50aec7c9a347d961c9d
Opcode Fuzzy Hash: b927ae74619758a598cfc9270831e4a31ed0d6aa4f6bb5add9ed4790784cb533
Instruction Fuzzy Hash: D531703264AAA0C5FA1E9FB6E54536826B5F766BD4F1ECD20EF1506B18EF36C091C300

Function 61B1E770 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

src/math/rand_prime.c, xrefs: 61B1E8B6
N != NULL, xrefs: 61B1E8BD

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID:
String ID: N != NULL$src/math/rand_prime.c
API String ID: 0-3192267683
Opcode ID: 1cbc81b8573c0c28a796ed0c228a5a614023403950c6f6348fa2b0dd56f1f495
Instruction ID: 98e68a1f046a9c4d44c70465c08ff632da9c0c24eb1638975e6f8b45fcc47180
Opcode Fuzzy Hash: 1cbc81b8573c0c28a796ed0c228a5a614023403950c6f6348fa2b0dd56f1f495
Instruction Fuzzy Hash: 5E31266230868185FB2A9A57F80179E6B65F7C6BE8F4D8225ED198BF98DB38C041C700

Function 61B7D320 Relevance: 7.6, APIs: 5, Instructions: 56timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 61B7D365
GetCurrentProcessId.KERNEL32 ref: 61B7D370
GetCurrentThreadId.KERNEL32 ref: 61B7D379
GetTickCount.KERNEL32 ref: 61B7D381
QueryPerformanceCounter.KERNEL32 ref: 61B7D38E

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 93b6f95df46dcfb8700c2fdce4609375bd01251149d930a2bdc71f59330368f3
Instruction ID: 2004addb4242c61ecbba8b596e659295f4f4faa30272d1cdc7727844d5a4e8b2
Opcode Fuzzy Hash: 93b6f95df46dcfb8700c2fdce4609375bd01251149d930a2bdc71f59330368f3
Instruction Fuzzy Hash: C111BF7A225A4081FB109B21F80439977A1B749BF0F082B74EE5C037B4DB3CC4968700

Function 61B09890 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 61B07CA0: _PyFloat_Unpack8.PYTHON39 ref: 61B07CD1

PyErr_Occurred.PYTHON39 ref: 61B098B4
PyErr_Occurred.PYTHON39 ref: 61B09A7D

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_Occurred$Float_Unpack8
String ID:
API String ID: 3006406168-0
Opcode ID: 47afa62a8177051337b94968dc14042afe213ee857901c0413ebd47eb1c42671
Instruction ID: 764f9a08b4ff993efb62b8751ff4bc8266926cdc35b694b5d2b421c8b9d8e037
Opcode Fuzzy Hash: 47afa62a8177051337b94968dc14042afe213ee857901c0413ebd47eb1c42671
Instruction Fuzzy Hash: 641184712456D086F90DCB75C0A475A3B69EB86B82F06FB05C90E27260DF35D5C2C740

Function 61B097D3 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 61B080F0: memcpy.MSVCRT ref: 61B08149
Part of subcall function 61B080F0: PyOS_string_to_double.PYTHON39 ref: 61B0815B

PyErr_Occurred.PYTHON39 ref: 61B097F7
PyErr_Occurred.PYTHON39 ref: 61B09ADD

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_Occurred$S_string_to_doublememcpy
String ID:
API String ID: 282781714-0
Opcode ID: 25f70a189c164c6dd830f08d9b3fe38686469130f539b155406aeb4c73cb39b1
Instruction ID: ca01db5aff0b12f7e503de5b2c6ddf0324c6af609ff46426e22840c816c6db9b
Opcode Fuzzy Hash: 25f70a189c164c6dd830f08d9b3fe38686469130f539b155406aeb4c73cb39b1
Instruction Fuzzy Hash: 181193716456D086F90ECB75C0A4B4A3B65FB86B82F0AEB05CE0E27260DF35D5C6CB90

Function 00007FF79968A6F4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F), ref: 00007FF79968A705
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F), ref: 00007FF79968A724
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F), ref: 00007FF79968A74C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F), ref: 00007FF79968A75D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF799692433,?,?,?,00007FF79968CB8C,?,?,00000000,00007FF799683A5F), ref: 00007FF79968A76E

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8a1bb1fb30c776521f71cd7f268cc6825f5a57dec437cff5255c4fa0cbf0b49a
Instruction ID: c600ec7857520844fcbcd2d6753b112b199179e28c033915c05c953ea5b01934
Opcode Fuzzy Hash: 8a1bb1fb30c776521f71cd7f268cc6825f5a57dec437cff5255c4fa0cbf0b49a
Instruction Fuzzy Hash: 8C11D638A09202C2FA79BE73486617AD2B34F65770F981734D97E0A2D2ED2CB8419231

Function 61B5AE30 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 233fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61B5B0E4
abort.MSVCRT ref: 61B5B0E9

Strings

illegal index register, xrefs: 61B5B0CF
', xrefs: 61B5B14E

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: abortfwrite
String ID: '$illegal index register
API String ID: 1067672060-451399654
Opcode ID: cf684d3f0c9f7f0cca09918a640f5996643ad27ccaa16bf0039dacbc564c5efe
Instruction ID: a5651358368c348204955916088e8502dd3e9c0ef09020ed6bda2da3f09e441a
Opcode Fuzzy Hash: cf684d3f0c9f7f0cca09918a640f5996643ad27ccaa16bf0039dacbc564c5efe
Instruction Fuzzy Hash: 9C918EB361AB89C4DB178F3DE890A4C3F65E395F88B9AC112CA4C47760DA7EC566C710

Function 00007FF79968F198 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79968F477

Part of subcall function 00007FF799695474: _invalid_parameter_noinfo.LIBCMT ref: 00007FF799695491

Strings

UTF-16LEUNICODE, xrefs: 00007FF79968F415
UTF-8, xrefs: 00007FF79968F3F6
ccs, xrefs: 00007FF79968F3B2

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction ID: 6a04b2884da6226e2135f1ea046e6eeccb1f56293f9bf8eeeaad9e54e848b90e
Opcode Fuzzy Hash: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction Fuzzy Hash: 2D818136E0C202C6F7B47E3F8110278F6B2AB15B88FD58035DA6997295DF2DE90197E1

Function 00007FF79967E464 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF79967E48C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF79967E574

Strings

csm, xrefs: 00007FF79967E5C6
csm, xrefs: 00007FF79967E4AE

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction ID: f4ee3320e5ad9ff6ad4ec54d7b9544e339ecb18db1cc1e515017a1ebf144bc10
Opcode Fuzzy Hash: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction Fuzzy Hash: 3D51A23290874286FB75AF359144268B7B2EB64B88F944135DAEC47BE9CF3CE454CB20

Function 00007FFDFAFC2833 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

..\s\crypto\async\async.c, xrefs: 00007FFDFB0833EF, 00007FFDFB08343D, 00007FFDFB083456, 00007FFDFB08348C, 00007FFDFB0834D6, 00007FFDFB08352C, 00007FFDFB08354D, 00007FFDFB08356B, 00007FFDFB0835A5, 00007FFDFB0835CA
T, xrefs: 00007FFDFB083563

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID:
String ID: ..\s\crypto\async\async.c$T
API String ID: 0-2182492907
Opcode ID: a33d45e2f4587f719cdbf1e34ec74563639429da3cbb627bda4703f90277fc8c
Instruction ID: 69314d499552acb54e24fa60154af59bbede7c8a01173d0890c162ffad3f6ada
Opcode Fuzzy Hash: a33d45e2f4587f719cdbf1e34ec74563639429da3cbb627bda4703f90277fc8c
Instruction Fuzzy Hash: 18519E31B0AA4392F724DB12D4209B96360EF85798F445134EA6D4BBEEDF3DE609D700

Function 00007FFDFAFC3841 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

Strings

..\s\crypto\bio\b_sock.c, xrefs: 00007FFDFB089F2A, 00007FFDFB089FAD
host=, xrefs: 00007FFDFB08A01E
J, xrefs: 00007FFDFB089FA5

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID:
String ID: ..\s\crypto\bio\b_sock.c$J$host=
API String ID: 0-1729655730
Opcode ID: 01b0efafc7697a4f7d6a1a530da6b0f90e7318cc905d80235fe94a0ed0c4634c
Instruction ID: e756614e6d76a02d8ecc5a0a79635ebb3faf8019d73c57e20142dd82c6f9a584
Opcode Fuzzy Hash: 01b0efafc7697a4f7d6a1a530da6b0f90e7318cc905d80235fe94a0ed0c4634c
Instruction Fuzzy Hash: AB318E22B0894282EB14DB56F4619AEA360FF85794F440135FBAD87BEEDF3DD6418B00

Function 61B0F750 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 61B0F7A9
memcpy.MSVCRT ref: 61B0F7CC
fwrite.MSVCRT ref: 61B0F85C

Strings

Failed to alloc memory for bcc code, xrefs: 61B0F847

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: AllocVirtualfwritememcpy
String ID: Failed to alloc memory for bcc code
API String ID: 1603020442-783995166
Opcode ID: 8125d5d4d242057d8e641c681b9bf580e3305c09e402686b5e960c2fff33bb74
Instruction ID: d1044b77ec8c620ef9003d8ba4e92cd0cac257f108950b99a6c5a6f8c44912f9
Opcode Fuzzy Hash: 8125d5d4d242057d8e641c681b9bf580e3305c09e402686b5e960c2fff33bb74
Instruction Fuzzy Hash: 05218DB2702B9486DB548F1AE8807AC7BA4F70DFD9F48952ADE0C43750EB38C1A2C350

Function 00007FF7996724D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF799677A30: MultiByteToWideChar.KERNEL32 ref: 00007FF799677A6A

MessageBoxW.USER32 ref: 00007FF7996725D7
MessageBoxA.USER32 ref: 00007FF7996725F3

Strings

%s%s: %s, xrefs: 00007FF799672558
Fatal error detected, xrefs: 00007FF7996725AB, 00007FF7996725E5

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction ID: 5b8e46e8302c47d9ea066a141f81b2a46648a287224672c7f22f75f15ca7f6ef
Opcode Fuzzy Hash: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction Fuzzy Hash: 7A31007262878191F630AF21E4516EAA3B6FB84784F804136EA9D47A99DE3CD245CB50

Function 61B093C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON39 ref: 61B093D0
PyErr_SetString.PYTHON39 ref: 61B09B39

Strings

bad marshal data (string size out of range), xrefs: 61B09B2F

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$OccurredString
String ID: bad marshal data (string size out of range)
API String ID: 114435612-3115314950
Opcode ID: 1d62c9c056b0a62089bfdcbe7dea841679c6faaf2440bd8da759e1b7d3d14c27
Instruction ID: 260cdf2e2ff16058c5302c240d4a7b3ce2fa52701e354c6553f29e91524bbe12
Opcode Fuzzy Hash: 1d62c9c056b0a62089bfdcbe7dea841679c6faaf2440bd8da759e1b7d3d14c27
Instruction Fuzzy Hash: 5B11A3322066C486FA1ACB15E4407AA7BA5FF88B96F09D524CE4D07764EF38D886C740

Function 00007FFDFAEA5964 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_PyUnicode_ToNumeric.PYTHON39 ref: 00007FFDFAEA59A7
PyErr_SetString.PYTHON39 ref: 00007FFDFAEA59CF
PyFloat_FromDouble.PYTHON39 ref: 00007FFDFAEA59E1

Strings

not a numeric character, xrefs: 00007FFDFAEA59C5

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: DoubleErr_Float_FromNumericStringUnicode_
String ID: not a numeric character
API String ID: 727557307-2058156748
Opcode ID: 7b2889b2e6f4d5ab35650cae7173551541f9cb47526f84e30736909e8f3659dc
Instruction ID: bfc1933485df7c816b5e03d04ceb47f16dbfec59c6bc8344f296b7263868c374
Opcode Fuzzy Hash: 7b2889b2e6f4d5ab35650cae7173551541f9cb47526f84e30736909e8f3659dc
Instruction Fuzzy Hash: BA11C6D1B0C64281FF1D6725E47093853A4AFD6B64F15C1B0CA7F0E2D8DF2DE8458220

Function 00007FFDFAEA4B70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_PyUnicode_ToDecimalDigit.PYTHON39 ref: 00007FFDFAEA4BA9
PyErr_SetString.PYTHON39 ref: 00007FFDFAEA4BC9
PyLong_FromLong.PYTHON39 ref: 00007FFDFAEA4BDD

Strings

not a decimal, xrefs: 00007FFDFAEA4BBF

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: DecimalDigitErr_FromLongLong_StringUnicode_
String ID: not a decimal
API String ID: 2585962759-3590249192
Opcode ID: e78934462dd6755412ee24927d6af393205d162cf34f3a61138b07234db5534c
Instruction ID: 181488e3adfc9ed9e1164c8beba31613a8e90904036484b97278553de75e6632
Opcode Fuzzy Hash: e78934462dd6755412ee24927d6af393205d162cf34f3a61138b07234db5534c
Instruction Fuzzy Hash: EB0152A2B0C64681EF1CAB25D474B7862A1EFC4B44F5980B0C92F4E2D8DE2DE8498300

Function 61B09970 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON39 ref: 61B09BF9
PyErr_Occurred.PYTHON39 ref: 61B09DF9
PyErr_SetString.PYTHON39 ref: 61B0A79F

Strings

bad marshal data (invalid reference), xrefs: 61B09BEC, 61B0A792

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_$String$Occurred
String ID: bad marshal data (invalid reference)
API String ID: 1118661901-2759865940
Opcode ID: 90ad3d2e094f843839b28ef2bcd9419247b64dc6aec6734996e13390556df507
Instruction ID: fb11b3a1924c173885d2e2b91d66f6b5f033efaeeaac4ba4fddc56841d2c419e
Opcode Fuzzy Hash: 90ad3d2e094f843839b28ef2bcd9419247b64dc6aec6734996e13390556df507
Instruction Fuzzy Hash: 0B114CB1205AC1C2EA08CF26D49479D3B7AF785BA5F4AEA01DA0E47364DF35D8D5C780

Function 00007FFDFAFC139D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FFDFB08AD60
WSAGetLastError.WS2_32 ref: 00007FFDFB08AD6B

Strings

2, xrefs: 00007FFDFB08AD95
..\s\crypto\bio\b_sock2.c, xrefs: 00007FFDFB08AD81, 00007FFDFB08AD9D

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: ErrorLastsocket
String ID: ..\s\crypto\bio\b_sock2.c$2
API String ID: 1120909799-2051290508
Opcode ID: 7734bc7eb848a8c2f13e03d8370f2b6d25dc2938cf9324aa6d1bac55b8e4a966
Instruction ID: 01123226eb5f508138b98360a6bc75fd967fb3ab5acf46ed6044f4052434a851
Opcode Fuzzy Hash: 7734bc7eb848a8c2f13e03d8370f2b6d25dc2938cf9324aa6d1bac55b8e4a966
Instruction Fuzzy Hash: 9001C031F0994382E7209B26E4149AD6260FF45769F504335F67D87AE9CF3DEA42C740

Function 00007FF799673BA0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF799673699), ref: 00007FF799673BD1

Part of subcall function 00007FF799672620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF799677744,?,?,?,?,?,?,?,?,?,?,?,00007FF79967101D), ref: 00007FF799672654
Part of subcall function 00007FF799672620: MessageBoxW.USER32 ref: 00007FF79967272C

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF799673C0A
GetModuleFileNameW, xrefs: 00007FF799673BE2
Failed to get executable path., xrefs: 00007FF799673BDB

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction ID: dffbce791132760f5be8225a78daa5b0ea1281113cd13322f5da4ed9f6b4ff4e
Opcode Fuzzy Hash: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction Fuzzy Hash: 3F018B61B1D74281FA31BF30E8163B992B7AF587C4FC01136E96E86782EE5CE2449730

Function 61B11B60 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 61B11B64
FormatMessageA.KERNEL32 ref: 61B11B95
LocalFree.KERNEL32 ref: 61B11BB6

Strings

../src/platforms/windows/hdinfo.c, xrefs: 61B11BA0

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: ../src/platforms/windows/hdinfo.c
API String ID: 1365068426-2451707101
Opcode ID: 047e74e7558a874c33a40e3203b1a6c171f422d825aa74040d68500aaa8d39d5
Instruction ID: 0d2def3d536db2f8b20cac7f6acc245fb84d9c8977853cc1ab40b2768d53a2d7
Opcode Fuzzy Hash: 047e74e7558a874c33a40e3203b1a6c171f422d825aa74040d68500aaa8d39d5
Instruction Fuzzy Hash: 88F03936204A4086E7109B11F85478A7B62F3CAB95F545129EB8E42B74DF3EC11A8B50

Function 00007FFDFB1E99F0 Relevance: 6.5, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,?,00000000,?,00007FFDFB1EA0D3), ref: 00007FFDFB1E9B85
memcmp.VCRUNTIME140(?,?,?,00000000,?,00007FFDFB1EA0D3), ref: 00007FFDFB1E9B9D
memcmp.VCRUNTIME140(?,?,?,00000000,?,00007FFDFB1EA0D3), ref: 00007FFDFB1E9BB5
memcmp.VCRUNTIME140(?,?,?,00000000,?,00007FFDFB1EA0D3), ref: 00007FFDFB1E9BF1
memcmp.VCRUNTIME140(?,?,?,00000000,?,00007FFDFB1EA0D3), ref: 00007FFDFB1E9CD6

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 06533f56ebbf768209d34c10d8a7c5afb5f4e7864eca73073be81a017dffc2ce
Instruction ID: 4414b731da1a876e21880b456f4a1cc6ddf4ffea8317986322b1e0865634e245
Opcode Fuzzy Hash: 06533f56ebbf768209d34c10d8a7c5afb5f4e7864eca73073be81a017dffc2ce
Instruction Fuzzy Hash: 09918F62F0965785FB109B62D960ABD53A2BF407D8F409035EE2D5BAEDEE38F505C300

Function 00007FFDFAFC643D Relevance: 6.4, APIs: 2, Strings: 2, Instructions: 395COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFB1A773D
memset.VCRUNTIME140 ref: 00007FFDFB1A77A9

Strings

..\s\crypto\sm2\sm2_crypt.c, xrefs: 00007FFDFB1A7776, 00007FFDFB1A77B4, 00007FFDFB1A77C8, 00007FFDFB1A77E0, 00007FFDFB1A7843, 00007FFDFB1A788A, 00007FFDFB1A78B2, 00007FFDFB1A78F7, 00007FFDFB1A7913, 00007FFDFB1A7925, 00007FFDFB1A7945, 00007FFDFB1A79A0, 00007FFDFB1A7C8B, 00007FFDFB1A7CD3, 00007FFDFB1A7CFD, 00007FFDFB1A7D2C
@, xrefs: 00007FFDFB1A7ACA

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: memset
String ID: ..\s\crypto\sm2\sm2_crypt.c$@
API String ID: 2221118986-485510600
Opcode ID: cd74a8d878f1a5f0695a56e3f7fb90c4b032a70a3b36df810eff86d90cd88446
Instruction ID: 898094859d7ddd60abc6b86eef23d63c0c5aeb744b985bda884be410b40afeb6
Opcode Fuzzy Hash: cd74a8d878f1a5f0695a56e3f7fb90c4b032a70a3b36df810eff86d90cd88446
Instruction Fuzzy Hash: 99028572B09A8381E714DF16E4509AE6764FF84B98F404235EA9D4BBE9DF3DE605CB00

Function 00007FF79968BA70 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF79968BAEF
WriteFile.KERNEL32 ref: 00007FF79968BDB7
WriteFile.KERNEL32 ref: 00007FF79968BDFD
GetLastError.KERNEL32 ref: 00007FF79968BEB3

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction ID: cd3ab9652e57334b64d9d140007e6eed0ed1f8a5953b3dcaa2a7ada916a12d81
Opcode Fuzzy Hash: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction Fuzzy Hash: B7D1E232B18A8089F760DF76D4442ACB7B2FB447D8B844235CE6E97B99DE38D006C350

Function 00007FFDFAFC382D Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

), xrefs: 00007FFDFB14A84B
..\s\crypto\evp\p5_crpt.c, xrefs: 00007FFDFB14A55C, 00007FFDFB14A606, 00007FFDFB14A7F5, 00007FFDFB14A824, 00007FFDFB14A853

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID:
String ID: )$..\s\crypto\evp\p5_crpt.c
API String ID: 0-3563398421
Opcode ID: a0ff16798964d517f23f621a694b9ffa1db1e9190bfdfc635015992b37e2d6c0
Instruction ID: 740f6b661980b0b39a48c5ec99e426554e9946067113912929e075da8cca9fd2
Opcode Fuzzy Hash: a0ff16798964d517f23f621a694b9ffa1db1e9190bfdfc635015992b37e2d6c0
Instruction Fuzzy Hash: 5691B763F1928386FB24DB129420ABA6350FF86798F555231E96D4BADDDF3CE641CB00

Function 00007FF79968C430 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF79968C41B), ref: 00007FF79968C54C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF79968C41B), ref: 00007FF79968C5D7

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction ID: 30e1ae8f8c507c5048c9ea03a093e4303d58a9be075483731615929946d2bb71
Opcode Fuzzy Hash: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction Fuzzy Hash: DA91F362E08652C5F770AF3694402BDEBB2BB54B88F941139DE1E63A84DF3DD481C720

Function 00007FFDFAFC2DEC Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFDFB12A4D0

Strings

unknown, xrefs: 00007FFDFB12A503, 00007FFDFB12A5CA
Operation not permitted, xrefs: 00007FFDFB12A4C4

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: ErrorLast
String ID: Operation not permitted$unknown
API String ID: 1452528299-31098287
Opcode ID: 60a88963b320452ba2e7d5cb71e0c19f448a51f504cb7ea22ed3b1f741502950
Instruction ID: bd1d2c9d5efa5ae39455632889ab91c4119f0664eb9b02b3bbc97ae0ecef62fd
Opcode Fuzzy Hash: 60a88963b320452ba2e7d5cb71e0c19f448a51f504cb7ea22ed3b1f741502950
Instruction Fuzzy Hash: 6A815D22F1A64386EB149B12E874B7923A0FF95798F440231ED6D8B2EDDF3CE5458740

Function 00007FFDFAEA1F40 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAEA1F78
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAEA1F96

Strings

CJK UNIFIED IDEOGRAPH-, xrefs: 00007FFDFAEA1F8C
HANGUL SYLLABLE , xrefs: 00007FFDFAEA1F65

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: strncmp
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 1114863663-87138338
Opcode ID: 28284ee8d92930c45441912fa1ba1437306f5e879eb558367f422bc488895435
Instruction ID: 4772982f8e246423aee416d8f2730c43b291a37915eb3aa0eb47a7132f75bedb
Opcode Fuzzy Hash: 28284ee8d92930c45441912fa1ba1437306f5e879eb558367f422bc488895435
Instruction Fuzzy Hash: 7E614BB2B1864246E768EA19A460F7A7692FF80B90F044235E97F4BADDEF3DD405D700

Function 00007FFDFAFC153C Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFDFB0CFB55
memmove.VCRUNTIME140 ref: 00007FFDFB0CFC03
memmove.VCRUNTIME140 ref: 00007FFDFB0CFC8D

Strings

..\s\crypto\ct\ct_oct.c, xrefs: 00007FFDFB0CFA85, 00007FFDFB0CFB7D, 00007FFDFB0CFB9B, 00007FFDFB0CFC17, 00007FFDFB0CFC33, 00007FFDFB0CFC5D, 00007FFDFB0CFC75

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: memmove
String ID: ..\s\crypto\ct\ct_oct.c
API String ID: 2162964266-1972679481
Opcode ID: 4e82cae2aa1f4f7bbf4560a5a95d76e090609bb2fa029e246dc49390338f2df8
Instruction ID: ce2b3bc47d0e5da58411e86645d08ed4cd958c6b66f8a35d97fa01861a28c2d9
Opcode Fuzzy Hash: 4e82cae2aa1f4f7bbf4560a5a95d76e090609bb2fa029e246dc49390338f2df8
Instruction Fuzzy Hash: C171D6A270E68289E715CF2680605BC3B60EB19B88F044172EEAC473DFDF2CE659D701

Function 00007FFDFB073980 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 155stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB073A43
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB073A5B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB073A78

Strings

content-type, xrefs: 00007FFDFB07398A

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: strncmp
String ID: content-type
API String ID: 1114863663-3266185539
Opcode ID: 00a341a851545be2a8da524dcddeb1d98576832106f68cef986c537e7134ac14
Instruction ID: 94bb520f3802a1047d46bcf1819ec6378646c035f3878c03157c7bdbdb8fcd29
Opcode Fuzzy Hash: 00a341a851545be2a8da524dcddeb1d98576832106f68cef986c537e7134ac14
Instruction Fuzzy Hash: FE510712B0E54351FB649716A471F7AA290FF86BA4F545230EE7D876EDEE2CE6039300

Function 61B01010 Relevance: 6.1, APIs: 4, Instructions: 131sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 61B01057
_amsg_exit.MSVCRT ref: 61B01081

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 3bd0c23425649b6bf193be68188acf9665ad97c27ff63b365e523a2827455451
Instruction ID: 4bd53e6bef18b85a50da582b0f294ab9d175883dba409d783c69f22d07c55230
Opcode Fuzzy Hash: 3bd0c23425649b6bf193be68188acf9665ad97c27ff63b365e523a2827455451
Instruction Fuzzy Hash: 5C41923670258485F74E9B5BEC903992A76FB89B9AF4CC426DE1C47350EF39C492C350

Function 61B1F3E0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

Strings

in != NULL, xrefs: 61B1F539
src/pk/asn1/der/sequence/der_decode_sequence_multi.c, xrefs: 61B1F532

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID:
String ID: in != NULL$src/pk/asn1/der/sequence/der_decode_sequence_multi.c
API String ID: 0-85593093
Opcode ID: e8f480885e395630eee45c4c510c24453715282040474754120cd5fc0b3a0d7b
Instruction ID: 470df0db023f03e25cd94759c76c69df5f28408974996694c79e49d89c94f915
Opcode Fuzzy Hash: e8f480885e395630eee45c4c510c24453715282040474754120cd5fc0b3a0d7b
Instruction Fuzzy Hash: 7A3104327096C08AEB19CF6AE402B9D7225F785BD8F99D02CDE5D47B58DB39C44AC700

Function 00007FFDFAFC1C76 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 57stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFB17662A

Strings

X9.42 DH PARAMETERS, xrefs: 00007FFDFB176619
DH PARAMETERS, xrefs: 00007FFDFB1765DB
..\s\crypto\pem\pem_pkey.c, xrefs: 00007FFDFB176654, 00007FFDFB176679, 00007FFDFB176690

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: strcmp
String ID: ..\s\crypto\pem\pem_pkey.c$DH PARAMETERS$X9.42 DH PARAMETERS
API String ID: 1004003707-3633731555
Opcode ID: 030a65f3e35046576361d430bfd6d990099fe8f2133a894fb164c9d84277bcde
Instruction ID: 66493bc4fb8f3dc1351365b12afb07ac9ca8780b0b7b5cc87dfadfc442c57567
Opcode Fuzzy Hash: 030a65f3e35046576361d430bfd6d990099fe8f2133a894fb164c9d84277bcde
Instruction Fuzzy Hash: EC21C721B0964781EB10DB52F4609A9A7A0FF857A4F504131FAAC477EDEF7DD254CB04

Function 61B09934 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 61B080F0: memcpy.MSVCRT ref: 61B08149
Part of subcall function 61B080F0: PyOS_string_to_double.PYTHON39 ref: 61B0815B

PyErr_Occurred.PYTHON39 ref: 61B09954
PyFloat_FromDouble.PYTHON39 ref: 61B09B04

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: DoubleErr_Float_FromOccurredS_string_to_doublememcpy
String ID:
API String ID: 1362591179-0
Opcode ID: 2a781aa106d92ce728ea6b428f98ef3ad4ed2d3642e3f3361321aee736f867b9
Instruction ID: 5efa58799fe88fcf4ffac9f1d095048c9a1d39557686adabbb25fbb923c226cc
Opcode Fuzzy Hash: 2a781aa106d92ce728ea6b428f98ef3ad4ed2d3642e3f3361321aee736f867b9
Instruction Fuzzy Hash: 4101217120568086F60DDB75C5A8B5E7BAAEB86756F0BEA04CE0A17260DF35E485CB80

Function 61B09780 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 61B07CA0: _PyFloat_Unpack8.PYTHON39 ref: 61B07CD1

PyErr_Occurred.PYTHON39 ref: 61B097A0
PyFloat_FromDouble.PYTHON39 ref: 61B09AA4

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Float_$DoubleErr_FromOccurredUnpack8
String ID:
API String ID: 4123378784-0
Opcode ID: 147a72d495da75988711dfb8c43eae631405d574ee493734c14594fd00201ddf
Instruction ID: 7620ed43d713e89a00234f1f34cd981e573c3b2ddf390a77280724d7ccf68b46
Opcode Fuzzy Hash: 147a72d495da75988711dfb8c43eae631405d574ee493734c14594fd00201ddf
Instruction Fuzzy Hash: D401757120629087F90DCB65C5A8B5E7BAAEB86742F16EA04CE0A07250DB35E4C1CB80

Function 61B09690 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON39 ref: 61B0969A
PyLong_FromLong.PYTHON39 ref: 61B0A154

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_FromLongLong_Occurred
String ID:
API String ID: 4098471257-0
Opcode ID: 3a48faebf6879efb2eab34b28e51c189b61e8a672321ff99561f056f55394361
Instruction ID: ba344f7e6db1be14c50036e5d1a7db34502b14c4a71f8076762646a102aacd40
Opcode Fuzzy Hash: 3a48faebf6879efb2eab34b28e51c189b61e8a672321ff99561f056f55394361
Instruction Fuzzy Hash: F201FF7130669086FA0CCB75C4E8B5E3BA6EB86B42F0AE914CE1A07250DF34D885CB80

Function 00007FF799694D3C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7996908A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7996908D3

_get_daylight.LIBCMT ref: 00007FF799694E54
_get_daylight.LIBCMT ref: 00007FF799694E65

Strings

?, xrefs: 00007FF799694DE5

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 8b5d587ec6f6b7eed71ba39116b338de031c50ce5c8dd23bba2b14458f06a6e4
Instruction ID: 6b01e440941dc5163ab57b0ecb3ed7e5a68d92ee47a57b60a1306a6ed90a2512
Opcode Fuzzy Hash: 8b5d587ec6f6b7eed71ba39116b338de031c50ce5c8dd23bba2b14458f06a6e4
Instruction Fuzzy Hash: 73411613B0829256FB74AF36941137AE6B2EF85BA4F944235EF6C07AD9DE3CD4418710

Function 00007FFDFAFC2743 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFDFB06A8A2

Strings

%04d%02d%02d%02d%02d%02dZ, xrefs: 00007FFDFB06A9A8
%02d%02d%02d%02d%02d%02dZ, xrefs: 00007FFDFB06A9B5

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: _time64
String ID: %02d%02d%02d%02d%02d%02dZ$%04d%02d%02d%02d%02d%02dZ
API String ID: 1670930206-2648760357
Opcode ID: 35c0674a6fc9a5195c317095fe527ac94bcdae6bb520b7aade9e85fd0519ba43
Instruction ID: 104a1084bdd030ca991e00cb6c324ee77ca02b8a290dac0a43c91bf7ae2bd8da
Opcode Fuzzy Hash: 35c0674a6fc9a5195c317095fe527ac94bcdae6bb520b7aade9e85fd0519ba43
Instruction Fuzzy Hash: 8251B532B0D7828AE760DF15E451B6AB7A1FB89790F144131EA9D87BADDF3CE5408B00

Function 00007FFDFAFC1613 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FFDFB086B6E
getaddrinfo.WS2_32 ref: 00007FFDFB086BAF

Strings

..\s\crypto\bio\b_addr.c, xrefs: 00007FFDFB086BDC, 00007FFDFB086C23, 00007FFDFB086C4F

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: getaddrinfo
String ID: ..\s\crypto\bio\b_addr.c
API String ID: 300660673-2547254400
Opcode ID: cee4118a91f4e298bb24630199019e17d2161ccb3740edd78188986782efcc03
Instruction ID: 58f8cebfe5abcad5c4f1c76298455d1bac899c4a0a1a117c901299c3b2c1f489
Opcode Fuzzy Hash: cee4118a91f4e298bb24630199019e17d2161ccb3740edd78188986782efcc03
Instruction Fuzzy Hash: DE41F572B18A8387E714DF12A850ABA7390FB85784F018135FAA947BE9DF3CD5459B04

Function 00007FF799687E6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF799687E9E

Part of subcall function 00007FF799689E18: RtlFreeHeap.NTDLL(?,?,?,00007FF799691E42,?,?,?,00007FF799691E7F,?,?,00000000,00007FF799692345,?,?,?,00007FF799692277), ref: 00007FF799689E2E
Part of subcall function 00007FF799689E18: GetLastError.KERNEL32(?,?,?,00007FF799691E42,?,?,?,00007FF799691E7F,?,?,00000000,00007FF799692345,?,?,?,00007FF799692277), ref: 00007FF799689E38

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF79967B105), ref: 00007FF799687EBC

Strings

C:\Users\user\Desktop\datasett.exe, xrefs: 00007FF799687EAA

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\datasett.exe
API String ID: 3580290477-1493852099
Opcode ID: 7be78eb059dea3495cc358456d23a898a8a026444ba3d0a56d0d7994263981b4
Instruction ID: d69124471f018cccae0e80c5d84f1b3ef7d7639a628cb99532278cae2eb1c6d6
Opcode Fuzzy Hash: 7be78eb059dea3495cc358456d23a898a8a026444ba3d0a56d0d7994263981b4
Instruction Fuzzy Hash: 26413D32A08B52C5FB24EF3694800B8E7BAEF45794BD44035EA5E47B85DF3DE5518360

Function 00007FF79968E508 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF79968E548
GetCurrentDirectoryW.KERNEL32 ref: 00007FF79968E59A

Strings

:, xrefs: 00007FF79968E55E

Memory Dump Source

Source File: 00000001.00000002.2914051498.00007FF799671000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF799670000, based on PE: true

Associated: 00000001.00000002.2913966908.00007FF799670000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914079249.00007FF79969A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914103850.00007FF7996BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2914192435.00007FF7996BE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff799670000_datasett.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 8d0047e3d49e2942e9dd2ecd46bdb5543a301835a32119f1e21a6d0f1ab18d67
Instruction ID: a09eeda34d77d794f760f5627ac5d5e08f744e5ed0c2a8ee637f2b01ea036148
Opcode Fuzzy Hash: 8d0047e3d49e2942e9dd2ecd46bdb5543a301835a32119f1e21a6d0f1ab18d67
Instruction Fuzzy Hash: 2F21C162B0868182FB31BF26D45426DE3B3FB98B84FC54035DAAC03684DF7DE9458761

Function 00007FFDFAFC3387 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FFDFB08A197
WSAGetLastError.WS2_32 ref: 00007FFDFB08A1A2

Strings

..\s\crypto\bio\b_sock.c, xrefs: 00007FFDFB08A156, 00007FFDFB08A1B8, 00007FFDFB08A1D4, 00007FFDFB08A207

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: ErrorLastgetsockname
String ID: ..\s\crypto\bio\b_sock.c
API String ID: 566540725-540685895
Opcode ID: 3f7e4d637075843b50ffdfd6546d49ef448eefcf8eb4d6d42073b27a69ad320d
Instruction ID: 92503147ae632237ec23ffdb9da8cbdf6333493e9a05068d1fbafd3e6cbc45c2
Opcode Fuzzy Hash: 3f7e4d637075843b50ffdfd6546d49ef448eefcf8eb4d6d42073b27a69ad320d
Instruction Fuzzy Hash: A121AE71B4950792E711DB21E824AED6360EF81715F800231E67C46AE8DF3DE685DB00

Function 61B07570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON39 ref: 61B075D0

Strings

%s (%d:%d), xrefs: 61B075C3

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: Err_Format
String ID: %s (%d:%d)
API String ID: 376477240-1595188566
Opcode ID: 00c3533c023e4da3be8f580cc063e031e8879b4c214c86249d69b3b2627af083
Instruction ID: c416941eeea2aa90f20695cdbd0374834c98be1a298bd9f5e6dde5f4c6bccc82
Opcode Fuzzy Hash: 00c3533c023e4da3be8f580cc063e031e8879b4c214c86249d69b3b2627af083
Instruction Fuzzy Hash: 0401D633A006D481F708A719E8803DD7B61EB8AB55F8D9121CE9D173A1DF6AC982C380

Function 00007FFDFAEA562C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON39 ref: 00007FFDFAEA567C
PyUnicode_FromString.PYTHON39 ref: 00007FFDFAEA5693

Strings

no such name, xrefs: 00007FFDFAEA5672

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: String$Err_FromUnicode_
String ID: no such name
API String ID: 3678473424-4211486178
Opcode ID: c693d65a71385824535150e9ecccdcb2d57a8484d62f3ec6bd54bdc843b8de53
Instruction ID: 1e60758b8ac3a6cdb871c6103a25f9bce5f22473b1703e42a021a2b407aaeee3
Opcode Fuzzy Hash: c693d65a71385824535150e9ecccdcb2d57a8484d62f3ec6bd54bdc843b8de53
Instruction Fuzzy Hash: 9B014FB1B18942C1FB24AB21E820BB563A4EF99B44F410071DA6F4E698EE2DE4058610

Function 00007FFDFAEA4F7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

_PyUnicode_ToDigit.PYTHON39 ref: 00007FFDFAEA4F87
PyErr_SetString.PYTHON39 ref: 00007FFDFAEA4FA7

Strings

not a digit, xrefs: 00007FFDFAEA4F9D

Memory Dump Source

Source File: 00000001.00000002.2914267094.00007FFDFAEA1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFDFAEA0000, based on PE: true

Associated: 00000001.00000002.2914243897.00007FFDFAEA0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAEA6000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF02000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF4E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAF52000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914286336.00007FFDFAFAB000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914528563.00007FFDFAFAF000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2914549078.00007FFDFAFB1000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaea0000_datasett.jbxd

Similarity

API ID: DigitErr_StringUnicode_
String ID: not a digit
API String ID: 1987352478-3016634541
Opcode ID: 0b9ad4f3aa939a32d557f2305bb1fb67aaf27e1b0e1bf64190b3ffb6a1a6d7d6
Instruction ID: 54214e43a8e947dc28a4a37b349d3ab53e3560338e70f858062d86e4fc4c01f4
Opcode Fuzzy Hash: 0b9ad4f3aa939a32d557f2305bb1fb67aaf27e1b0e1bf64190b3ffb6a1a6d7d6
Instruction Fuzzy Hash: 77F03095B0890781FF1C6B259470C7452A0EF99F48B0824B0C93F8E2D8EE1EA8998300

Function 00007FFDFAFC6BEA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FFDFB08A352
WSAGetLastError.WS2_32 ref: 00007FFDFB08A35E

Strings

..\s\crypto\bio\b_sock.c, xrefs: 00007FFDFB08A374

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: ErrorLastioctlsocket
String ID: ..\s\crypto\bio\b_sock.c
API String ID: 1021210092-540685895
Opcode ID: 4461a209f28e95a1d17e1fe27fd0101058cda89b9424f7b2e88bf19f5e6d7981
Instruction ID: 1c05b01698bed256cab0767572527e4273978e7ff1aebf686832a75623132d43
Opcode Fuzzy Hash: 4461a209f28e95a1d17e1fe27fd0101058cda89b9424f7b2e88bf19f5e6d7981
Instruction Fuzzy Hash: 28E09A60F4B90387F3126B629824F792350AF0974AF004230F93D8AAE8DE3DE2588A04

Function 00007FFDFB1FB3F0 Relevance: 5.2, APIs: 4, Instructions: 239COMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(00007FFDFB1FB35B,00000000,?,00000000,00007FFDFB1FA5F9), ref: 00007FFDFB1FB52B
memchr.VCRUNTIME140(00007FFDFB1FB35B,00000000,?,00000000,00007FFDFB1FA5F9), ref: 00007FFDFB1FB573
memchr.VCRUNTIME140(00007FFDFB1FB35B,00000000,?,00000000,00007FFDFB1FA5F9), ref: 00007FFDFB1FB58D

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: memchr
String ID:
API String ID: 3297308162-0
Opcode ID: 894b152478e49585909b4f884bd3c79ebd5a6dd4ef0c1a77e308b87e5181a23f
Instruction ID: dc4095066a53e4d24a43de99729a945616ec5f540a16aa027eda1fcd1cb4695b
Opcode Fuzzy Hash: 894b152478e49585909b4f884bd3c79ebd5a6dd4ef0c1a77e308b87e5181a23f
Instruction Fuzzy Hash: BC91EA6BF096C281EB208B16D5A453AABA1FB85BC8F584035DF5D837F9CE2DE445C700

Function 00007FFDFAFC53E4 Relevance: 5.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFDFB0B98E0
memmove.VCRUNTIME140 ref: 00007FFDFB0B98F0
memmove.VCRUNTIME140 ref: 00007FFDFB0B9900
memmove.VCRUNTIME140 ref: 00007FFDFB0B9910

Memory Dump Source

Source File: 00000001.00000002.2914592961.00007FFDFAFC1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDFAFC0000, based on PE: true

Associated: 00000001.00000002.2914572919.00007FFDFAFC0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFAFCD000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB025000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB039000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB04A000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB050000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB05D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914592961.00007FFDFB20D000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB20F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB23A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB26B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB291000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2914870560.00007FFDFB2B7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915017062.00007FFDFB2DF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915036786.00007FFDFB2E5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB2E7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB303000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2915055494.00007FFDFB307000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfafc0000_datasett.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: a23466d681eb0a4b59ef0f4ee0ccc74a58dbd7c3bc8a430191d22eb2a2f2a2f8
Instruction ID: 63ad0262b3f7ca1018deca4d8afeb89371ef42ecfdb318eda129833c1ee759e8
Opcode Fuzzy Hash: a23466d681eb0a4b59ef0f4ee0ccc74a58dbd7c3bc8a430191d22eb2a2f2a2f8
Instruction Fuzzy Hash: D6119362B0564292D750DB2AE6505E96360FF447D0F848531FBAD87BEEEF28E591C700

Function 61B7E010 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 61B7E037
free.MSVCRT ref: 61B7E088
LeaveCriticalSection.KERNEL32 ref: 61B7E094

Memory Dump Source

Source File: 00000001.00000002.2911374689.0000000061B01000.00000020.00000001.01000000.00000008.sdmp, Offset: 61B00000, based on PE: true

Associated: 00000001.00000002.2911344158.0000000061B00000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911460298.0000000061B7F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911478424.0000000061B83000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911507002.0000000061B84000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911548166.0000000061B99000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911569567.0000000061B9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911595706.0000000061BA0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2911625399.0000000061BA4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_61b00000_datasett.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: f98d655d79458ae7ef109b3067db563f1dde0830edff20af3cbcf19b1a5ba07b
Instruction ID: 3e3a696539e60969143b9ca1d2a8864a7afd2aef09b89adbf086b137fbb3e046
Opcode Fuzzy Hash: f98d655d79458ae7ef109b3067db563f1dde0830edff20af3cbcf19b1a5ba07b
Instruction Fuzzy Hash: CC01757131564487EB1DCBA6E8923DD2362FBC9B44F989819DA2D87310EB29C4A6C340

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report datasett.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Common\en-US\sapi.dll.mui

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Common\sapi.dll

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\en-US\srloc.dll.mui

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\spsreng.dll

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\spsrx.dll

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\SR\srloc.dll

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\TTS\MSTTSEngine.dll

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\Engines\TTS\MSTTSLoc.dll

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SPTIP.DLL

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUX.dll

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUXPS.DLL

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\SpeechUXWiz.exe

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUX.dll.mui

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUXRes.dll

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\SpeechUXWiz.exe.mui

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\sapi.cpl.mui

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\en-US\speechuxcpl.dll.mui

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\ru-RU\SpeechUX.dll.mui

C:\Users\user\AppData\Local\Temp\_MEI50522\Speech\SpeechUX\ru-RU\SpeechUXWiz.exe.mui

Windows Analysis Report
datasett.exe

C:\Users\user\AppData\Local\Temp\_MEI50522\init.py

C:\Users\user\AppData\Local\Temp\_MEI50522\pycache\init.cpython-39.pyc

C:\Users\user\AppData\Local\Temp\_MEI68642\init.py

C:\Users\user\AppData\Local\Temp\_MEI68642\pycache\init.cpython-39.pyc

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre