Edit tour

Windows Analysis Report
3OQL58yflv.exe

Overview

General Information

Sample name:	3OQL58yflv.exe renamed because original name is a hash value
Original sample name:	230f90bb0e0b11907854e59e63a040b0524fe3e3d6790d290d6fca8d2e0a73f0.exe
Analysis ID:	1581648
MD5:	6cb409f46ff2c5fff4dccec2daa01c68
SHA1:	da84249c2f7ec40d36c2cd0771d6587471ef6c8a
SHA256:	230f90bb0e0b11907854e59e63a040b0524fe3e3d6790d290d6fca8d2e0a73f0
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Metasploit

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Metasploit Payload

AI detected suspicious sample

Contains functionality to infect the boot sector

Binary contains a suspicious time stamp

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to enumerate running services

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

3OQL58yflv.exe (PID: 6300 cmdline: "C:\Users\user\Desktop\3OQL58yflv.exe" MD5: 6CB409F46FF2C5FFF4DCCEC2DAA01C68)

3OQL58yflv.exe (PID: 6520 cmdline: "C:\Users\user\Desktop\3OQL58yflv.exe" MD5: 6CB409F46FF2C5FFF4DCCEC2DAA01C68)

cleanup

Malware Configuration

Threatname: Metasploit

{"Type": "Metasploit Connect", "IP": "202.182.125.24", "Port": 20529}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2934511808.00000225EDFB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000001.00000002.2934511808.00000225EDFB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x81:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000001.00000002.2934511808.00000225EDFB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_91bc5d7d	unknown	unknown	0xd7:$a: 49 BE 77 73 32 5F 33 32 00 00 41 56 49 89 E6 48 81 EC A0 01 00 00 49 89 E5
00000001.00000002.2933864941.00000225ED810000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x8f6b1:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000001.00000002.2933864941.00000225ED810000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_91bc5d7d	unknown	unknown	0x8f707:$a: 49 BE 77 73 32 5F 33 32 00 00 41 56 49 89 E6 48 81 EC A0 01 00 00 49 89 E5
00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x126e1:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_91bc5d7d	unknown	unknown	0x12737:$a: 49 BE 77 73 32 5F 33 32 00 00 41 56 49 89 E6 48 81 EC A0 01 00 00 49 89 E5
Click to see the 3 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000001.00000002.2934511808.00000225EDFB0000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Metasploit {"Type": "Metasploit Connect", "IP": "202.182.125.24", "Port": 20529}

Multi AV Scanner detection for submitted file

Source: 3OQL58yflv.exe

Virustotal: Detection: 16%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10256244 CRYPTO_memcmp,		1_2_00007FFE10256244
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE102518E0 _Py_NoneStruct,_PyArg_UnpackKeywords,PyObject_GetBuffer,PyBuffer_IsContiguous,PyObject_GetBuffer,PyBuffer_IsContiguous,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,EVP_PBE_scrypt,PyBytes_FromStringAndSize,PyEval_SaveThread,EVP_PBE_scrypt,PyEval_RestoreThread,PyExc_ValueError,PyErr_SetString,PyBuffer_Release,PyBuffer_Release,PyLong_AsLong,PyErr_Occurred,PyLong_AsLong,PyErr_Occurred,PyExc_ValueError,PyExc_ValueError,PyErr_Format,_PyArg_BadArgument,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_OverflowError,PyExc_OverflowError,_Py_Dealloc,PyExc_ValueError,		1_2_00007FFE102518E0

Source: 3OQL58yflv.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685684873.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685933492.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682887726.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: ucrtbase.pdb source: 3OQL58yflv.exe, 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683521043.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682580120.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: 3OQL58yflv.exe, 00000001.00000002.2935012657.00007FFDFAF72000.00000002.00000001.01000000.00000011.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1684849273.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685493954.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1686006892.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: 3OQL58yflv.exe, 00000000.00000003.1680057346.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683186995.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685040237.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1684537254.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685334865.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: 3OQL58yflv.exe, 00000001.00000002.2938699098.00007FFE13341000.00000002.00000001.01000000.00000008.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682696579.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2937619663.00007FFE10257000.00000002.00000001.01000000.00000010.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683784354.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682389062.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682771950.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685220203.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: pyexpat.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938312798.00007FFE11EDD000.00000002.00000001.01000000.0000000A.sdmp, _bz2.pyd.0.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683980243.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: ucrtbase.pdbUGP source: 3OQL58yflv.exe, 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmp, _socket.pyd.0.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1686189826.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: 3OQL58yflv.exe, 00000001.00000002.2936020627.00007FFDFB5F3000.00000002.00000001.01000000.00000005.sdmp, python312.dll.0.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683032791.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2935427863.00007FFDFB1DF000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: libcrypto-3.dll.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: 3OQL58yflv.exe, 00000001.00000002.2935012657.00007FFDFAF72000.00000002.00000001.01000000.00000011.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1684691070.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683702539.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682504937.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685143237.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 3OQL58yflv.exe, 00000000.00000003.1680057346.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685749217.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683446448.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: libcrypto-3.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683862948.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938612939.00007FFE13303000.00000002.00000001.01000000.0000000D.sdmp, select.pyd.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683590185.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1686295316.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1684084374.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1684968920.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1684460676.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682958033.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdbEE source: libssl-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmp, _lzma.pyd.0.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685823423.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683331738.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, _queue.pyd.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683259370.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938526688.00007FFE130C4000.00000002.00000001.01000000.00000012.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938526688.00007FFE130C4000.00000002.00000001.01000000.00000012.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2932965280.00000225EB5D0000.00000002.00000001.01000000.00000007.sdmp, python3.dll.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: libssl-3.dll.0.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685560720.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1686079093.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: _ssl.pyd.0.dr

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E37788D0 FindFirstFileExW,FindClose,	0_2_00007FF6E37788D0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3787E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF6E3787E4C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3791EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6E3791EE4
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3787E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF6E3787E4C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013F304C FindFirstFileExW,FindNextFileW,FindClose,	1_2_00007FFE013F304C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013F3290 FindFirstFileExW,FindNextFileW,FindClose,	1_2_00007FFE013F3290

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 1_2_00007FFE10302E70 memset,PyList_New,SetErrorMode,PyArg_ParseTuple,PyObject_IsTrue,PyEval_SaveThread,GetLogicalDriveStringsA,PyEval_RestoreThread,PyErr_SetFromWindowsErr,SetErrorMode,PyEval_SaveThread,GetDriveTypeA,PyEval_RestoreThread,GetVolumeInformationA,strcat_s,SetLastError,strcat_s,strcat_s,strcat_s,FindFirstVolumeMountPointA,strcpy_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,FindNextVolumeMountPointA,FindVolumeMountPointClose,strcat_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,strchr,SetErrorMode,FindVolumeMountPointClose,SetErrorMode,_Py_Dealloc,_Py_Dealloc,

1_2_00007FFE10302E70

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 202.182.125.24:20529

Source: Joe Sandbox View

ASN Name: AS-CHOOPAUS AS-CHOOPAUS

Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 202.182.125.24

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 1_2_00007FFE11516594 memset,recvfrom,

1_2_00007FFE11516594

Source: 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED971000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4A7000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9A4000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: 3OQL58yflv.exe, 00000000.00000003.1689563389.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680323317.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1690397598.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B1384000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688540462.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 3OQL58yflv.exe, 00000000.00000003.1689563389.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680323317.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1690397598.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B1384000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688540462.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 3OQL58yflv.exe, 00000000.00000003.1689563389.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680323317.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1690397598.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B1384000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688540462.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 3OQL58yflv.exe, 00000000.00000003.1689563389.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680323317.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1690397598.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B1384000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688540462.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digi
Source: 3OQL58yflv.exe, 00000000.00000003.1689563389.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680323317.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1690397598.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B1384000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688540462.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 3OQL58yflv.exe, 00000000.00000003.1689563389.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680323317.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1690397598.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B1384000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688540462.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 3OQL58yflv.exe, 00000000.00000003.1689563389.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680323317.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1690397598.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B1384000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688540462.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: python312.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 3OQL58yflv.exe, 00000000.00000003.1689563389.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680323317.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1690397598.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B1384000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688540462.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4A7000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED971000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4A7000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: 3OQL58yflv.exe, 00000001.00000002.2934131144.00000225EDD10000.00000004.00001000.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1705716830.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2934131144.00000225EDD98000.00000004.00001000.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933864941.00000225ED810000.00000004.00001000.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2934261575.00000225EDE10000.00000004.00001000.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1706113469.00000225ED5D9000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: 3OQL58yflv.exe, 00000001.00000002.2933723346.00000225ED610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/zeJZl.
Source: 3OQL58yflv.exe, 00000001.00000002.2933864941.00000225ED810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: 3OQL58yflv.exe, 00000000.00000003.1689563389.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680323317.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1690397598.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B1384000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688540462.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: 3OQL58yflv.exe, 00000000.00000003.1689563389.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680323317.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1690397598.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B1384000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688540462.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: 3OQL58yflv.exe, 00000000.00000003.1689563389.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680323317.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1690397598.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B1384000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688540462.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 3OQL58yflv.exe, 00000000.00000003.1689563389.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680323317.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1690397598.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B1384000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688540462.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: 3OQL58yflv.exe, 00000001.00000002.2934261575.00000225EDE28000.00000004.00001000.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2934131144.00000225EDDD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4A7000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: 3OQL58yflv.exe, 00000000.00000003.1689563389.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680323317.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1690397598.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B1384000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1687337747.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1688540462.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9C5000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: 3OQL58yflv.exe, 00000001.00000003.1705716830.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1704847466.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703984622.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: 3OQL58yflv.exe, 00000001.00000003.1706551243.00000225ED441000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1702820222.00000225ED447000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1704184836.00000225ED447000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1705187832.00000225ED44A000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703332592.00000225ED447000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: 3OQL58yflv.exe, 00000001.00000002.2933281372.00000225ED0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: 3OQL58yflv.exe, 00000001.00000002.2934131144.00000225EDD10000.00000004.00001000.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703940257.00000225ED5D9000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703940257.00000225ED5CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/openssl/openssl/blob/master/include/openssl/pem.h
Source: 3OQL58yflv.exe, 00000001.00000002.2933192259.00000225ED04C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: 3OQL58yflv.exe, 00000001.00000002.2933281372.00000225ED0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: 3OQL58yflv.exe, 00000001.00000002.2933281372.00000225ED0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: 3OQL58yflv.exe, 00000001.00000003.1703547252.00000225ED5C8000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1705716830.00000225ED4D3000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703739611.00000225ED5DF000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703984622.00000225ED4D3000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1704847466.00000225ED4D3000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: 3OQL58yflv.exe, 00000001.00000002.2933281372.00000225ED0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: 3OQL58yflv.exe, 00000001.00000003.1706113469.00000225ED5D9000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933864941.00000225ED8F8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tqdm/tqdm#contributions
Source: 3OQL58yflv.exe, 00000001.00000002.2933864941.00000225ED8F8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tqdm/tqdm#contributionstegerame.
Source: 3OQL58yflv.exe, 00000001.00000002.2933864941.00000225ED810000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tqdm/tqdm/issues/481)
Source: 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: 3OQL58yflv.exe, 00000001.00000002.2933794424.00000225ED710000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: 3OQL58yflv.exe, 00000001.00000002.2936020627.00007FFDFB5F3000.00000002.00000001.01000000.00000005.sdmp, python312.dll.0.dr	String found in binary or memory: https://peps.python.org/pep-0263/
Source: 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED939000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/18603270/
Source: 3OQL58yflv.exe, 00000001.00000002.2934131144.00000225EDD10000.00000004.00001000.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703940257.00000225ED5D9000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703940257.00000225ED5CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4A7000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4A7000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4D3000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2935326347.00007FFDFB0B3000.00000002.00000001.01000000.00000011.sdmp, libcrypto-3.dll.0.dr, libssl-3.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: 3OQL58yflv.exe, 00000001.00000003.1696978814.00000225ED146000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933192259.00000225ECFD0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: 3OQL58yflv.exe, 00000001.00000002.2936346938.00007FFDFB76B000.00000008.00000001.01000000.00000005.sdmp, python312.dll.0.dr	String found in binary or memory: https://www.python.org/psf/license/
Source: 3OQL58yflv.exe, 00000001.00000002.2936020627.00007FFDFB5F3000.00000002.00000001.01000000.00000005.sdmp, python312.dll.0.dr	String found in binary or memory: https://www.python.org/psf/license/)

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000001.00000002.2934511808.00000225EDFB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000001.00000002.2934511808.00000225EDFB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_91bc5d7d Author: unknown
Source: 00000001.00000002.2933864941.00000225ED810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000001.00000002.2933864941.00000225ED810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_91bc5d7d Author: unknown
Source: 00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_91bc5d7d Author: unknown

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10301E90 PyList_New,GetActiveProcessorCount,PyErr_SetFromWindowsErr,_Py_Dealloc,free,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,PyExc_RuntimeError,PyErr_SetString,malloc,PyErr_NoMemory,NtQuerySystemInformation,Py_BuildValue,PyList_Append,_Py_Dealloc,free,_Py_Dealloc,	1_2_00007FFE10301E90
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10304A70 PyArg_ParseTuple,OpenProcess,GetLastError,GetProcessHeap,HeapAlloc,NtQueryVirtualMemory,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQueryVirtualMemory,PyExc_RuntimeError,PyErr_SetString,CloseHandle,PyErr_Clear,GetProcessHeap,HeapFree,CloseHandle,GetProcessHeap,HeapFree,CloseHandle,Py_BuildValue,PyErr_NoMemory,CloseHandle,	1_2_00007FFE10304A70
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10306250 GetProcessHeap,HeapAlloc,GetFileType,SetLastError,NtQueryObject,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,PyErr_NoMemory,GetProcessHeap,HeapFree,	1_2_00007FFE10306250
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10306E40 PyExc_RuntimeError,PyErr_SetString,OpenProcess,GetLastError,NtQueryInformationProcess,CloseHandle,CloseHandle,calloc,PyErr_NoMemory,CloseHandle,NtQueryInformationProcess,calloc,PyErr_NoMemory,free,CloseHandle,wcscpy_s,free,CloseHandle,	1_2_00007FFE10306E40
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10306AA0 OpenProcess,GetLastError,NtQueryInformationProcess,RtlNtStatusToDosErrorNoTeb,PyErr_SetFromWindowsErrWithFilename,CloseHandle,ReadProcessMemory,GetLastError,CloseHandle,ReadProcessMemory,NtQueryInformationProcess,CloseHandle,ReadProcessMemory,ReadProcessMemory,VirtualQueryEx,GetLastError,PyErr_SetFromWindowsErrWithFilename,CloseHandle,calloc,PyErr_NoMemory,CloseHandle,ReadProcessMemory,GetLastError,CloseHandle,free,CloseHandle,	1_2_00007FFE10306AA0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10302480 GetActiveProcessorCount,PyErr_SetFromWindowsErr,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,PyExc_RuntimeError,PyErr_SetString,malloc,PyErr_NoMemory,NtQuerySystemInformation,free,malloc,PyErr_NoMemory,NtQuerySystemInformation,malloc,PyErr_NoMemory,NtQuerySystemInformation,free,free,free,free,free,Py_BuildValue,	1_2_00007FFE10302480
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10304680 PyArg_ParseTuple,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,Py_BuildValue,PyUnicode_FromWideChar,GetProcessHeap,HeapFree,PyErr_NoMemory,	1_2_00007FFE10304680
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE103073F0 malloc,NtQuerySystemInformation,free,malloc,PyErr_NoMemory,free,free,	1_2_00007FFE103073F0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10305720 PyArg_ParseTuple,OpenProcess,GetLastError,NtQueryInformationProcess,CloseHandle,Py_BuildValue,	1_2_00007FFE10305720
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10305810 PyArg_ParseTuple,OpenProcess,GetLastError,NtSetInformationProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct,	1_2_00007FFE10305810
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10304D00 PyArg_ParseTuple,OpenProcess,GetLastError,PyObject_IsTrue,NtSuspendProcess,NtResumeProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct,	1_2_00007FFE10304D00
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10306600 PyList_New,EnterCriticalSection,GetProcessHeap,HeapAlloc,PyErr_NoMemory,_Py_Dealloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,PyExc_RuntimeError,PyErr_SetString,GetCurrentProcess,DuplicateHandle,PyUnicode_FromWideChar,PyList_Append,_Py_Dealloc,GetProcessHeap,HeapFree,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,_Py_Dealloc,GetProcessHeap,HeapFree,LeaveCriticalSection,	1_2_00007FFE10306600

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 1_2_00007FFE10302B00: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle,

1_2_00007FFE10302B00

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3796370	0_2_00007FF6E3796370
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E37972BC	0_2_00007FF6E37972BC
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3777950	0_2_00007FF6E3777950
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3790F38	0_2_00007FF6E3790F38
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3781C90	0_2_00007FF6E3781C90
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3787C98	0_2_00007FF6E3787C98
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E378E4B0	0_2_00007FF6E378E4B0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E378A430	0_2_00007FF6E378A430
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3783AE4	0_2_00007FF6E3783AE4
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E378EB30	0_2_00007FF6E378EB30
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3794280	0_2_00007FF6E3794280
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3781A84	0_2_00007FF6E3781A84
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3790F38	0_2_00007FF6E3790F38
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E37822A4	0_2_00007FF6E37822A4
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3781880	0_2_00007FF6E3781880
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E37820A0	0_2_00007FF6E37820A0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3778FD0	0_2_00007FF6E3778FD0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3799FF8	0_2_00007FF6E3799FF8
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E378E01C	0_2_00007FF6E378E01C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3771F50	0_2_00007FF6E3771F50
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3787E4C	0_2_00007FF6E3787E4C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E37886D0	0_2_00007FF6E37886D0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3791EE4	0_2_00007FF6E3791EE4
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E37836E0	0_2_00007FF6E37836E0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E379471C	0_2_00007FF6E379471C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3785F30	0_2_00007FF6E3785F30
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3787E4C	0_2_00007FF6E3787E4C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3781E94	0_2_00007FF6E3781E94
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E37965EC	0_2_00007FF6E37965EC
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3782D50	0_2_00007FF6E3782D50
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3796D70	0_2_00007FF6E3796D70
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFDFB0D18A0	1_2_00007FFDFB0D18A0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFDFB0D12F0	1_2_00007FFDFB0D12F0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE01388174	1_2_00007FFE01388174
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013921D0	1_2_00007FFE013921D0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE014100CC	1_2_00007FFE014100CC
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE01383274	1_2_00007FFE01383274
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0138233C	1_2_00007FFE0138233C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0139D460	1_2_00007FFE0139D460
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0138F500	1_2_00007FFE0138F500
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013AE770	1_2_00007FFE013AE770
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013826F8	1_2_00007FFE013826F8
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0138C950	1_2_00007FFE0138C950
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0138F880	1_2_00007FFE0138F880
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013ABB9C	1_2_00007FFE013ABB9C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013E7C2C	1_2_00007FFE013E7C2C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0138FC20	1_2_00007FFE0138FC20
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE01387C30	1_2_00007FFE01387C30
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013A5A40	1_2_00007FFE013A5A40
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013F2A78	1_2_00007FFE013F2A78
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013A0B10	1_2_00007FFE013A0B10
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0139CAC0	1_2_00007FFE0139CAC0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE01385DB4	1_2_00007FFE01385DB4
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE01428E08	1_2_00007FFE01428E08
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0138BC80	1_2_00007FFE0138BC80
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013A1C94	1_2_00007FFE013A1C94
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013F2C58	1_2_00007FFE013F2C58
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE01382FA0	1_2_00007FFE01382FA0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0139EF44	1_2_00007FFE0139EF44
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE01390FF0	1_2_00007FFE01390FF0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013C1EB0	1_2_00007FFE013C1EB0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0138EE40	1_2_00007FFE0138EE40
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE01425E74	1_2_00007FFE01425E74
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0E143300	1_2_00007FFE0E143300
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0E143A30	1_2_00007FFE0E143A30
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0E163870	1_2_00007FFE0E163870
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0E163140	1_2_00007FFE0E163140
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0E182540	1_2_00007FFE0E182540
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0E181D30	1_2_00007FFE0E181D30
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EA723E0	1_2_00007FFE0EA723E0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EA71FB0	1_2_00007FFE0EA71FB0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB24810	1_2_00007FFE0EB24810
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB245C0	1_2_00007FFE0EB245C0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB32490	1_2_00007FFE0EB32490
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB33520	1_2_00007FFE0EB33520
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB329B0	1_2_00007FFE0EB329B0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB32EB0	1_2_00007FFE0EB32EB0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB31FE0	1_2_00007FFE0EB31FE0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB31D70	1_2_00007FFE0EB31D70
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB42120	1_2_00007FFE0EB42120
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB41D30	1_2_00007FFE0EB41D30
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB51F00	1_2_00007FFE0EB51F00
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB521E0	1_2_00007FFE0EB521E0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE101D1F80	1_2_00007FFE101D1F80
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE101E2270	1_2_00007FFE101E2270
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE101E1D30	1_2_00007FFE101E1D30
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE101E2380	1_2_00007FFE101E2380
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10231D30	1_2_00007FFE10231D30
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10232280	1_2_00007FFE10232280
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10242150	1_2_00007FFE10242150
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE102512B0	1_2_00007FFE102512B0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE102518E0	1_2_00007FFE102518E0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10251000	1_2_00007FFE10251000
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10301E90	1_2_00007FFE10301E90
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10302E70	1_2_00007FFE10302E70
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10303990	1_2_00007FFE10303990
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10304DF0	1_2_00007FFE10304DF0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10308F30	1_2_00007FFE10308F30
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE103099D0	1_2_00007FFE103099D0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10302B00	1_2_00007FFE10302B00
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10306600	1_2_00007FFE10306600
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11071FE0	1_2_00007FFE11071FE0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11502230	1_2_00007FFE11502230
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11511220	1_2_00007FFE11511220
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11513AD0	1_2_00007FFE11513AD0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EA2520	1_2_00007FFE11EA2520
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EA8CD0	1_2_00007FFE11EA8CD0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EAF8BC	1_2_00007FFE11EAF8BC
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EA5C90	1_2_00007FFE11EA5C90
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EA2FD0	1_2_00007FFE11EA2FD0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EA1BA0	1_2_00007FFE11EA1BA0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EA5360	1_2_00007FFE11EA5360
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EA12B0	1_2_00007FFE11EA12B0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EA6E50	1_2_00007FFE11EA6E50
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11ED3F10	1_2_00007FFE11ED3F10
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11ED2F00	1_2_00007FFE11ED2F00
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11ED1000	1_2_00007FFE11ED1000
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EDC8BC	1_2_00007FFE11EDC8BC
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11ED3C80	1_2_00007FFE11ED3C80
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE130C10C0	1_2_00007FFE130C10C0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE130C1630	1_2_00007FFE130C1630
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE13333280	1_2_00007FFE13333280
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE1333530C	1_2_00007FFE1333530C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE148E2ED0	1_2_00007FFE148E2ED0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE148E39F0	1_2_00007FFE148E39F0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE148E32E0	1_2_00007FFE148E32E0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE148E3F50	1_2_00007FFE148E3F50
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE148E1F50	1_2_00007FFE148E1F50
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE148E27A0	1_2_00007FFE148E27A0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE1A457CA0	1_2_00007FFE1A457CA0

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: String function: 00007FFE10301070 appears 43 times
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: String function: 00007FFE10301D70 appears 39 times
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: String function: 00007FF6E3772B30 appears 47 times

Source: unicodedata.pyd.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: python3.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found

Source: 3OQL58yflv.exe, 00000000.00000003.1683032791.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1682887726.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1689563389.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1685334865.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1685933492.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1680057346.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1682580120.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1684849273.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1685143237.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1686295316.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1686006892.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1683862948.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1683590185.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1680323317.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1682958033.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1685749217.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1686189826.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1683186995.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1682771950.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1685560720.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1683259370.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1683702539.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1683980243.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1682389062.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1684968920.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1682504937.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1685220203.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1684084374.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1686079093.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1682696579.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1683784354.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1685040237.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1683331738.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1684460676.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1684537254.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1683446448.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1684691070.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1683521043.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1693113756.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1685493954.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1685823423.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1685684873.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe	Binary or memory string: OriginalFilename vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000001.00000002.2938345495.00007FFE11EE2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000001.00000002.2935701808.00007FFDFB1E4000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000001.00000002.2938646123.00007FFE13306000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000001.00000002.2938732915.00007FFE1334E000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000001.00000002.2936565159.00007FFDFB894000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000001.00000002.2938561193.00007FFE130C7000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000001.00000002.2932965280.00000225EB5D0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000001.00000002.2937648359.00007FFE1025E000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000001.00000002.2935326347.00007FFDFB0B3000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs 3OQL58yflv.exe
Source: 3OQL58yflv.exe, 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs 3OQL58yflv.exe

Source: 00000001.00000002.2934511808.00000225EDFB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000001.00000002.2934511808.00000225EDFB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_91bc5d7d reference_sample = 0dd993ff3917dc56ef02324375165f0d66506c5a9b9548eda57c58e041030987, os = windows, severity = x86, creation_date = 2021-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 8848a3de66a25dd98278761a7953f31b7995e48621dec258f3d92bd91a4a3aa3, id = 91bc5d7d-31e3-4c02-82b3-a685194981f3, last_modified = 2021-10-04
Source: 00000001.00000002.2933864941.00000225ED810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000001.00000002.2933864941.00000225ED810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_91bc5d7d reference_sample = 0dd993ff3917dc56ef02324375165f0d66506c5a9b9548eda57c58e041030987, os = windows, severity = x86, creation_date = 2021-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 8848a3de66a25dd98278761a7953f31b7995e48621dec258f3d92bd91a4a3aa3, id = 91bc5d7d-31e3-4c02-82b3-a685194981f3, last_modified = 2021-10-04
Source: 00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_91bc5d7d reference_sample = 0dd993ff3917dc56ef02324375165f0d66506c5a9b9548eda57c58e041030987, os = windows, severity = x86, creation_date = 2021-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 8848a3de66a25dd98278761a7953f31b7995e48621dec258f3d92bd91a4a3aa3, id = 91bc5d7d-31e3-4c02-82b3-a685194981f3, last_modified = 2021-10-04

Source: classification engine

Classification label: mal80.troj.winEXE@3/102@0/1

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 0_2_00007FF6E3778560 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF6E3778560

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 1_2_00007FFE10307DB0 GetCurrentProcess,OpenProcessToken,GetLastError,ImpersonateSelf,OpenProcessToken,GetLastError,PyErr_SetFromWindowsErrWithFilename,LookupPrivilegeValueA,GetLastError,PyErr_SetFromWindowsErrWithFilename,AdjustTokenPrivileges,GetLastError,PyErr_SetFromWindowsErrWithFilename,AdjustTokenPrivileges,RevertToSelf,CloseHandle,

1_2_00007FFE10307DB0

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 1_2_00007FFE10302A30 PyArg_ParseTuple,PyUnicode_AsWideCharString,PyEval_SaveThread,GetDiskFreeSpaceExW,PyEval_RestoreThread,PyMem_Free,PyExc_OSError,PyErr_SetExcFromWindowsErrWithFilenameObject,Py_BuildValue,

1_2_00007FFE10302A30

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 1_2_00007FFE10304DF0 PyList_New,PyArg_ParseTuple,CreateToolhelp32Snapshot,_Py_Dealloc,CloseHandle,CloseHandle,Thread32First,OpenThread,GetThreadTimes,Py_BuildValue,PyList_Append,_Py_Dealloc,CloseHandle,Thread32Next,CloseHandle,_Py_Dealloc,

1_2_00007FFE10304DF0

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 1_2_00007FFE10308AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct,

1_2_00007FFE10308AA0

Source: C:\Users\user\Desktop\3OQL58yflv.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI63002

Jump to behavior

Source: 3OQL58yflv.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3OQL58yflv.exe

Virustotal: Detection: 16%

Source: C:\Users\user\Desktop\3OQL58yflv.exe

File read: C:\Users\user\Desktop\3OQL58yflv.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\3OQL58yflv.exe "C:\Users\user\Desktop\3OQL58yflv.exe"
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Process created: C:\Users\user\Desktop\3OQL58yflv.exe "C:\Users\user\Desktop\3OQL58yflv.exe"
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Process created: C:\Users\user\Desktop\3OQL58yflv.exe "C:\Users\user\Desktop\3OQL58yflv.exe"	Jump to behavior

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Section loaded: mswsock.dll	Jump to behavior

Source: 3OQL58yflv.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 3OQL58yflv.exe

Static file information: File size 10580892 > 1048576

Source: 3OQL58yflv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 3OQL58yflv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 3OQL58yflv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 3OQL58yflv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 3OQL58yflv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 3OQL58yflv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 3OQL58yflv.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 3OQL58yflv.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685684873.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685933492.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682887726.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: ucrtbase.pdb source: 3OQL58yflv.exe, 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683521043.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682580120.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: 3OQL58yflv.exe, 00000001.00000002.2935012657.00007FFDFAF72000.00000002.00000001.01000000.00000011.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1684849273.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685493954.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1686006892.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: 3OQL58yflv.exe, 00000000.00000003.1680057346.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: 3OQL58yflv.exe, 00000000.00000003.1681536854.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683186995.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685040237.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1684537254.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685334865.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: 3OQL58yflv.exe, 00000001.00000002.2938699098.00007FFE13341000.00000002.00000001.01000000.00000008.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682696579.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: 3OQL58yflv.exe, 00000000.00000003.1680766930.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2937619663.00007FFE10257000.00000002.00000001.01000000.00000010.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683784354.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682389062.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682771950.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685220203.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: pyexpat.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: 3OQL58yflv.exe, 00000000.00000003.1680186279.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938312798.00007FFE11EDD000.00000002.00000001.01000000.0000000A.sdmp, _bz2.pyd.0.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683980243.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: ucrtbase.pdbUGP source: 3OQL58yflv.exe, 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: 3OQL58yflv.exe, 00000000.00000003.1681792361.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmp, _socket.pyd.0.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1686189826.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: 3OQL58yflv.exe, 00000001.00000002.2936020627.00007FFDFB5F3000.00000002.00000001.01000000.00000005.sdmp, python312.dll.0.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683032791.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 3OQL58yflv.exe, 00000000.00000003.1693570804.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2935427863.00007FFDFB1DF000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: libcrypto-3.dll.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: 3OQL58yflv.exe, 00000001.00000002.2935012657.00007FFDFAF72000.00000002.00000001.01000000.00000011.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1684691070.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683702539.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682504937.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685143237.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 3OQL58yflv.exe, 00000000.00000003.1680057346.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685749217.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683446448.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: libcrypto-3.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683862948.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: 3OQL58yflv.exe, 00000000.00000003.1692825548.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938612939.00007FFE13303000.00000002.00000001.01000000.0000000D.sdmp, select.pyd.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683590185.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1686295316.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1684084374.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1684968920.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1684460676.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682958033.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdbEE source: libssl-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: 3OQL58yflv.exe, 00000000.00000003.1681422874.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmp, _lzma.pyd.0.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685823423.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683331738.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: 3OQL58yflv.exe, 00000000.00000003.1681694406.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, _queue.pyd.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1683259370.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938526688.00007FFE130C4000.00000002.00000001.01000000.00000012.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: 3OQL58yflv.exe, 00000000.00000003.1682274213.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2938526688.00007FFE130C4000.00000002.00000001.01000000.00000012.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: 3OQL58yflv.exe, 00000000.00000003.1689711480.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2932965280.00000225EB5D0000.00000002.00000001.01000000.00000007.sdmp, python3.dll.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: libssl-3.dll.0.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1685560720.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 3OQL58yflv.exe, 00000000.00000003.1686079093.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: _ssl.pyd.0.dr

Source: 3OQL58yflv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 3OQL58yflv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 3OQL58yflv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 3OQL58yflv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 3OQL58yflv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: api-ms-win-crt-string-l1-1-0.dll.0.dr

Static PE information: 0xB7CAAB24 [Sat Sep 17 19:16:52 2067 UTC]

Source: 3OQL58yflv.exe	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E37B5004 push rsp; retf	0_2_00007FF6E37B5005
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013AF25D push rdi; ret	1_2_00007FFE013AF264
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013AF970 push rdi; ret	1_2_00007FFE013AF976
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013A9D25 push rdi; ret	1_2_00007FFE013A9D2B
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EAD3E8 push rbp; iretd	1_2_00007FFE11EAD3ED

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, \\.\PhysicalDrive%d	1_2_00007FFE10302B00
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, PhysicalDrive%i	1_2_00007FFE10302B00
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i	1_2_00007FFE10302B00
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i	1_2_00007FFE10302B00

Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_poly1305.pyd	Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, \\.\PhysicalDrive%d	1_2_00007FFE10302B00
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, PhysicalDrive%i	1_2_00007FFE10302B00
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i	1_2_00007FFE10302B00
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i	1_2_00007FFE10302B00

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 1_2_00007FFE10308AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct,

1_2_00007FFE10308AA0

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 0_2_00007FF6E37751E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF6E37751E0

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: PyList_New,OpenSCManagerA,GetLastError,PyErr_SetFromWindowsErrWithFilename,EnumServicesStatusExW,GetLastError,free,malloc,EnumServicesStatusExW,PyUnicode_FromWideChar,PyUnicode_FromWideChar,Py_BuildValue,PyList_Append,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,CloseServiceHandle,free,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,CloseServiceHandle,free,

1_2_00007FFE10308170

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_poly1305.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-16303

Source: C:\Users\user\Desktop\3OQL58yflv.exe

API coverage: 1.3 %

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E37788D0 FindFirstFileExW,FindClose,	0_2_00007FF6E37788D0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3787E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF6E3787E4C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3791EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6E3791EE4
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E3787E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF6E3787E4C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013F304C FindFirstFileExW,FindNextFileW,FindClose,	1_2_00007FFE013F304C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013F3290 FindFirstFileExW,FindNextFileW,FindClose,	1_2_00007FFE013F3290

Source: C:\Users\user\Desktop\3OQL58yflv.exe

1_2_00007FFE10302E70

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 1_2_00007FFE103018C0 PyModule_Create2,getenv,RtlGetVersion,GetSystemInfo,InitializeCriticalSection,PyModule_GetState,PyErr_NewException,_Py_Dealloc,PyErr_NewException,PyModule_AddObject,PyErr_NewException,PyModule_AddObject,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,

1_2_00007FFE103018C0

Source: 3OQL58yflv.exe, 00000001.00000002.2933281372.00000225ED0D0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 0_2_00007FF6E378ABD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6E378ABD8

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 0_2_00007FF6E3793AF0 GetProcessHeap,

0_2_00007FF6E3793AF0

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E377BCE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6E377BCE0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E378ABD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6E378ABD8
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E377C760 SetUnhandledExceptionFilter,	0_2_00007FF6E377C760
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 0_2_00007FF6E377C57C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6E377C57C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFDFB0D3068 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFB0D3068
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFDFB0D2AA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFB0D2AA0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013C98F4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE013C98F4
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE013F0F30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE013F0F30
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0E141A80 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE0E141A80
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0E141030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE0E141030
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0E161030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE0E161030
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0E161A80 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE0E161A80
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0E181960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE0E181960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0E181390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE0E181390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EA71960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE0EA71960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EA71390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE0EA71390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB21390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE0EB21390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB21960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE0EB21960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB31390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE0EB31390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB31960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE0EB31960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB41390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE0EB41390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB41960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE0EB41960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB51390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE0EB51390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB51960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE0EB51960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB61390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE0EB61390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE0EB61960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE0EB61960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE101D1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE101D1960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE101D1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE101D1390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE101E1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE101E1960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE101E1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE101E1390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10231960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE10231960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10231390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE10231390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10241960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE10241960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10241390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE10241390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10254660 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE10254660
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE10254090 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE10254090
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE1030A050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE1030A050
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE1030A978 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE1030A978
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11071960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE11071960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11071390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE11071390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE110F1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE110F1960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE110F1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE110F1390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11501390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE11501390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11501960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE11501960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11513398 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE11513398
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11512DD0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE11512DD0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE117E1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE117E1960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE117E1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE117E1390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11BB1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE11BB1390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11BB1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE11BB1960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EB3C90 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE11EB3C90
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EB36C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE11EB36C0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EDAB08 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE11EDAB08
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11EDA0C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE11EDA0C0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE120C1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE120C1960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE120C1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE120C1390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE12E11390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE12E11390
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE12E11960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE12E11960
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE130C30AC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE130C30AC
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE130C2BCC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE130C2BCC
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE133014F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE133014F0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE13301AC0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE13301AC0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE13335FA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE13335FA0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE13336544 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE13336544
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE148E52F0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE148E52F0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE148E4D20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE148E4D20
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE1A460AA8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE1A460AA8

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Process created: C:\Users\user\Desktop\3OQL58yflv.exe "C:\Users\user\Desktop\3OQL58yflv.exe"

Jump to behavior

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 0_2_00007FF6E3799E40 cpuid

0_2_00007FF6E3799E40

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: EnumSystemLocalesW,	1_2_00007FFE013EF36C
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	1_2_00007FFE013EF3D4
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: EnterCriticalSection,EnumSystemLocalesW,LeaveCriticalSection,	1_2_00007FFE013ED2F0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: GetProcAddress,GetLocaleInfoW,	1_2_00007FFE0139D5C0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	1_2_00007FFE013EF488
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_00007FFE013EF8D0
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_00007FFE013EFA58

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\ucrtbase.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\psutil\_psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63002\_wmi.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Queries volume information: C:\Users\user\Desktop\3OQL58yflv.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 0_2_00007FF6E377C460 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6E377C460

Source: C:\Users\user\Desktop\3OQL58yflv.exe

Code function: 0_2_00007FF6E3796370 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF6E3796370

Source: C:\Users\user\Desktop\3OQL58yflv.exe

1_2_00007FFE103018C0

Remote Access Functionality

Yara detected Metasploit Payload

Source: Yara match	File source: 00000001.00000002.2934511808.00000225EDFB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11515074 PySys_Audit,PyEval_SaveThread,bind,PyEval_RestoreThread,_Py_NoneStruct,		1_2_00007FFE11515074
Source: C:\Users\user\Desktop\3OQL58yflv.exe	Code function: 1_2_00007FFE11516078 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,listen,PyEval_RestoreThread,_Py_NoneStruct,		1_2_00007FFE11516078

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Service Execution	1 Windows Service	1 Access Token Manipulation	1 Access Token Manipulation	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Bootkit	1 Windows Service	11 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	11 Process Injection	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	2 Obfuscated Files or Information	NTDS	1 System Service Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Bootkit	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	35 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3OQL58yflv.exe	5%	ReversingLabs
3OQL58yflv.exe	17%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_ARC4.pyd	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_Salsa20.pyd	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_chacha20.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_pkcs1_decode.pyd	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_MD2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_MD4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_RIPEMD160.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA224.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA384.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA512.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_keccak.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_poly1305.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Math\_modexp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_curve25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_curve448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_ec_ws.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_ed25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_ed448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Util\_strxor.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs

Name	Source	Malicious	Reputation
http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf	3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4A7000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	3OQL58yflv.exe, 00000001.00000002.2933192259.00000225ED04C000.00000004.00001000.00020000.00000000.sdmp	false	high
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf	3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://stackoverflow.com/questions/18603270/	3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED939000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/giampaolo/psutil/issues/875.	3OQL58yflv.exe, 00000001.00000002.2934131144.00000225EDD10000.00000004.00001000.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703940257.00000225ED5D9000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703940257.00000225ED5CA000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.tarsnap.com/scrypt/scrypt-slides.pdf	3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9C5000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://tools.ietf.org/html/rfc5869	3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9C5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.python.org/download/releases/2.3/mro/.	3OQL58yflv.exe, 00000001.00000003.1696978814.00000225ED146000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933192259.00000225ECFD0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false	high
http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html	3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED971000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4A7000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9A4000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf	3OQL58yflv.exe, 00000001.00000002.2934131144.00000225EDD10000.00000004.00001000.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1705716830.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2934131144.00000225EDD98000.00000004.00001000.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933864941.00000225ED810000.00000004.00001000.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2934261575.00000225EDE10000.00000004.00001000.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1706113469.00000225ED5D9000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/tqdm/tqdm/issues/481)	3OQL58yflv.exe, 00000001.00000002.2933864941.00000225ED810000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	3OQL58yflv.exe, 00000001.00000002.2933281372.00000225ED0D0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/issues/86361.	3OQL58yflv.exe, 00000001.00000003.1703547252.00000225ED5C8000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1705716830.00000225ED4D3000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703739611.00000225ED5DF000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703984622.00000225ED4D3000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1704847466.00000225ED4D3000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4D3000.00000004.00000020.00020000.00000000.sdmp	false	high
http://mail.python.org/pipermail/python-dev/2012-June/120787.html.	3OQL58yflv.exe, 00000001.00000002.2933864941.00000225ED810000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/tqdm/tqdm#contributionstegerame.	3OQL58yflv.exe, 00000001.00000002.2933864941.00000225ED8F8000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	3OQL58yflv.exe, 00000001.00000002.2933281372.00000225ED0D0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://stackoverflow.com/questions/4457745#4457745.	3OQL58yflv.exe, 00000001.00000002.2934131144.00000225EDD10000.00000004.00001000.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703940257.00000225ED5D9000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703940257.00000225ED5CA000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl3.digi	3OQL58yflv.exe, 00000000.00000003.1682126183.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	false	high
http://goo.gl/zeJZl.	3OQL58yflv.exe, 00000001.00000002.2933723346.00000225ED610000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	3OQL58yflv.exe, 00000001.00000002.2933281372.00000225ED0D0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/tqdm/tqdm#contributions	3OQL58yflv.exe, 00000001.00000003.1706113469.00000225ED5D9000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933864941.00000225ED8F8000.00000004.00001000.00020000.00000000.sdmp	false	high
https://www.python.org/psf/license/	3OQL58yflv.exe, 00000001.00000002.2936346938.00007FFDFB76B000.00000008.00000001.01000000.00000005.sdmp, python312.dll.0.dr	false	high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	3OQL58yflv.exe, 00000001.00000003.1705716830.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1704847466.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703984622.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/openssl/openssl/blob/master/include/openssl/pem.h	3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4D3000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/multiprocessing.html	3OQL58yflv.exe, 00000001.00000003.1706551243.00000225ED441000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1702820222.00000225ED447000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1704184836.00000225ED447000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1705187832.00000225ED44A000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000003.1703332592.00000225ED447000.00000004.00000020.00020000.00000000.sdmp	false	high
http://cacerts.digicert.co	3OQL58yflv.exe, 00000000.00000003.1680501853.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://tools.ietf.org/html/rfc5297	3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4A7000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.openssl.org/H	3OQL58yflv.exe, 00000000.00000003.1688679282.000002C5B137E000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2935326347.00007FFDFB0B3000.00000002.00000001.01000000.00000011.sdmp, libcrypto-3.dll.0.dr, libssl-3.dll.0.dr	false	high
http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf	3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4A7000.00000004.00000020.00020000.00000000.sdmp	false	high
http://tools.ietf.org/html/rfc5297	3OQL58yflv.exe, 00000001.00000002.2934261575.00000225EDE28000.00000004.00001000.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2934131144.00000225EDDD0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://www.ietf.org/rfc/rfc2898.txt	3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4D3000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9C5000.00000004.00000020.00020000.00000000.sdmp	false	high
http://tools.ietf.org/html/rfc4880	3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED410000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm	3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9B4000.00000004.00000020.00020000.00000000.sdmp	false	high
https://tools.ietf.org/html/rfc3610	3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4A7000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9A4000.00000004.00000020.00020000.00000000.sdmp	false	high
https://peps.python.org/pep-0205/	3OQL58yflv.exe, 00000001.00000002.2933794424.00000225ED710000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false	high
https://www.python.org/psf/license/)	3OQL58yflv.exe, 00000001.00000002.2936020627.00007FFDFB5F3000.00000002.00000001.01000000.00000005.sdmp, python312.dll.0.dr	false	high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	3OQL58yflv.exe, 00000001.00000002.2933281372.00000225ED0D0000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.rfc-editor.org/info/rfc7253	3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9B4000.00000004.00000020.00020000.00000000.sdmp	false	high
http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf	3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4A7000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED9A4000.00000004.00000020.00020000.00000000.sdmp	false	high
https://peps.python.org/pep-0263/	3OQL58yflv.exe, 00000001.00000002.2936020627.00007FFDFB5F3000.00000002.00000001.01000000.00000005.sdmp, python312.dll.0.dr	false	high
http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf	3OQL58yflv.exe, 00000001.00000002.2933964505.00000225ED971000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED4A7000.00000004.00000020.00020000.00000000.sdmp, 3OQL58yflv.exe, 00000001.00000002.2933458373.00000225ED5C9000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
202.182.125.24	unknown	United States		20473	AS-CHOOPAUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581648
Start date and time:	2024-12-28 12:07:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3OQL58yflv.exe renamed because original name is a hash value
Original Sample Name:	230f90bb0e0b11907854e59e63a040b0524fe3e3d6790d290d6fca8d2e0a73f0.exe
Detection:	MAL
Classification:	mal80.troj.winEXE@3/102@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-CHOOPAUS	armv5l.elf	Get hash	malicious	Unknown	Browse	44.174.62.96
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	8.12.100.87
	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Get hash	malicious	NetSupport RAT	Browse	45.76.253.210
	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Get hash	malicious	NetSupport RAT	Browse	45.76.253.210
	armv5l.elf	Get hash	malicious	Mirai	Browse	66.42.103.144
	jklm68k.elf	Get hash	malicious	Unknown	Browse	44.40.163.25
	nabsh4.elf	Get hash	malicious	Unknown	Browse	44.172.196.44
	nabarm5.elf	Get hash	malicious	Unknown	Browse	217.163.30.244
	nklx86.elf	Get hash	malicious	Unknown	Browse	45.76.237.246
	nklppc.elf	Get hash	malicious	Unknown	Browse	173.199.121.211

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_ARC4.pyd	7zip.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, PRYSMAX STEALER	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	chos.exe	Get hash	malicious	Unknown	Browse
	ihost.exe	Get hash	malicious	Python Stealer, Muck Stealer	Browse
	shost.exe	Get hash	malicious	Python Stealer, Muck Stealer	Browse
	lz4wnSavmK.exe	Get hash	malicious	Python Stealer	Browse
	WVuXCNNYG0.exe	Get hash	malicious	Python Stealer	Browse
	dipwo1iToJ.exe	Get hash	malicious	Python Stealer	Browse
	ROh2ijuEpr.exe	Get hash	malicious	Babuk, Conti	Browse
C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_Salsa20.pyd	7zip.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, PRYSMAX STEALER	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	chos.exe	Get hash	malicious	Unknown	Browse
	ihost.exe	Get hash	malicious	Python Stealer, Muck Stealer	Browse
	shost.exe	Get hash	malicious	Python Stealer, Muck Stealer	Browse
	lz4wnSavmK.exe	Get hash	malicious	Python Stealer	Browse
	WVuXCNNYG0.exe	Get hash	malicious	Python Stealer	Browse
	dipwo1iToJ.exe	Get hash	malicious	Python Stealer	Browse
	ROh2ijuEpr.exe	Get hash	malicious	Babuk, Conti	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.640339306680604
Encrypted:	false
SSDEEP:	192:dLklddyTHThob0q/tJRrlDfNYSOcqgYCWt:ZgcdZq/JJD6gRWt
MD5:	BCD8CAAF9342AB891BB1D8DD45EF0098
SHA1:	EE7760BA0FF2548F25D764F000EFBB1332BE6D3E
SHA-256:	78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
SHA-512:	8B6FB53AECB514769985EBFDAB1B3C739024597D9C35905E04971D5422256546F7F169BF98F9BAF7D9F42A61CFF3EE7A20664989D3000773BF5EDA10CB3A0C24
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 1%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 7zip.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: chos.exe, Detection: malicious, Browse Filename: ihost.exe, Detection: malicious, Browse Filename: shost.exe, Detection: malicious, Browse Filename: lz4wnSavmK.exe, Detection: malicious, Browse Filename: WVuXCNNYG0.exe, Detection: malicious, Browse Filename: dipwo1iToJ.exe, Detection: malicious, Browse Filename: ROh2ijuEpr.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.0194545642425075
Encrypted:	false
SSDEEP:	192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
MD5:	F19CB847E567A31FAB97435536C7B783
SHA1:	4C8BFE404AF28C1781740E7767619A5E2D2FF2B7
SHA-256:	1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
SHA-512:	382DC205F703FC3E1F072F17F58E321E1A65B86BE7D9D6B07F24A02A156308A7FEC9B1A621BA1F3428FD6BB413D14AE9ECB2A2C8DD62A7659776CFFDEBB6374C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: 7zip.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: chos.exe, Detection: malicious, Browse Filename: ihost.exe, Detection: malicious, Browse Filename: shost.exe, Detection: malicious, Browse Filename: lz4wnSavmK.exe, Detection: malicious, Browse Filename: WVuXCNNYG0.exe, Detection: malicious, Browse Filename: dipwo1iToJ.exe, Detection: malicious, Browse Filename: ROh2ijuEpr.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.037456384995606
Encrypted:	false
SSDEEP:	192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDw6a9lkOcqgRGd:p/kpMIodrXbsiDS95gRGd
MD5:	DC14677EA8A8C933CC41F9CCF2BEDDC1
SHA1:	A6FB87E8F3540743097A467ABE0723247FDAF469
SHA-256:	68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
SHA-512:	3ABA4CFCBBE4B350AB3230D488BD75186427E3AAAF38D19E0E1C7330F16795AD77FB6E26FF39AF29EAF4F5E8C42118CB680F90AFBFCA218AEDA64DC444675BA2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.09191874780435
Encrypted:	false
SSDEEP:	192:rMVsiXeqVb0lIb0Pj5Jdfpm68WZDInU282tacqgYLg:rM7ali0Pj5JxCaDuUlgYLg
MD5:	C09BB8A30F0F733C81C5C5A3DAD8D76D
SHA1:	46FD3BA87A32D12F4EE14601D1AD73B78EDC81D1
SHA-256:	8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
SHA-512:	691AC74FAE930E9CEABE782567EFB99C50DD9B8AD607DD7F99A5C7DF2FA2BEB7EDFE2EBB7095A72DA0AE24E688FBABD340EAE8B646D5B8C394FEE8DDD5E60D31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.541423493519083
Encrypted:	false
SSDEEP:	384:f/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxme:klcR7JriEbwDaS4j990th9VDBV
MD5:	0AB25F99CDAACA6B11F2ECBE8223CAD5
SHA1:	7A881B3F84EF39D97A31283DE6D7B7AE85C8BAE6
SHA-256:	6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
SHA-512:	11E89EEF34398DF3B144A0303E08B3A4CAF41A9A8CA618C18135F561731F285F8CF821D81179C2C45F6EEB0E496D9DD3ECF6FF202A3C453C80AFEF8582D06C17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.367749645917753
Encrypted:	false
SSDEEP:	192:YiJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bD9JXx03cqg5YUMLgs:/k1kTMZEjCWNaA2DTx0g5YUMLg
MD5:	B6EA675C3A35CD6400A7ECF2FB9530D1
SHA1:	0E41751AA48108D7924B0A70A86031DDE799D7D6
SHA-256:	76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
SHA-512:	E31FD33E1ED6D4DA3957320250282CFD9EB3A64F12DE4BD2DFE3410F66725164D96B27CAA34C501D1A535A5A2442D5F070650FD3014B4B92624EE00F1C3F3197
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.41148259289073
Encrypted:	false
SSDEEP:	192:w3d9FkHaz0EJvrj+CYuz7ucc9dG7otDr22KcqgOiewZjW:YkHEJzj+X6769lDzagO/w
MD5:	F14E1AA2590D621BE8C10321B2C43132
SHA1:	FD84D11619DFFDF82C563E45B48F82099D9E3130
SHA-256:	FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
SHA-512:	A86B9DF163007277D26F2F732ECAB9DBCA8E860F8B5809784F46702D4CEA198824FDEF6AB98BA7DDC281E8791C10EABA002ABDA6F975323B36D5967E0443C1E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.041302713678401
Encrypted:	false
SSDEEP:	384:kUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8NDBcxgprAM:6NbRzWXwDqgLa1uBfP
MD5:	B127CAE435AEB8A2A37D2A1BC1C27282
SHA1:	2A7BF8BF7F24B2381370BA6B41FB640EE42BDCCD
SHA-256:	538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
SHA-512:	4FE027E46D5132CA63973C67BD5394F2AC74DD4BBCFE93CB16136FAB4B6BF67BECB5A0D4CA359FF9426DA63CA81F793BBF1B79C8A9D8372C53DCB5796D17367E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.530656045206549
Encrypted:	false
SSDEEP:	384:cEDwUBi9SPu71omZXmrfXA+UA10ol31tuXVYdAgYj:FsUBXmoEXmrXA+NNxWFYfo
MD5:	2E15AA6F97ED618A3236CFA920988142
SHA1:	A9D556D54519D3E91FA19A936ED291A33C0D1141
SHA-256:	516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
SHA-512:	A6C75C4A285753CC94E45500E8DD6B6C7574FB7F610FF65667F1BEC8D8B413FC10514B7D62F196C2B8D017C308C5E19E2AEF918021FA81D0CB3D8CED37D8549A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7080156150187396
Encrypted:	false
SSDEEP:	192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
MD5:	40390F2113DC2A9D6CFAE7127F6BA329
SHA1:	9C886C33A20B3F76B37AA9B10A6954F3C8981772
SHA-256:	6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
SHA-512:	617B963816838D649C212C5021D7D0C58839A85D4D33BBAF72C0EC6ECD98B609080E9E57AF06FA558FF302660619BE57CC974282826AB9F21AE0D80FBAA831A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.159963979391524
Encrypted:	false
SSDEEP:	192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
MD5:	899895C0ED6830C4C9A3328CC7DF95B6
SHA1:	C02F14EBDA8B631195068266BA20E03210ABEABC
SHA-256:	18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
SHA-512:	0B4C50E40AF92BC9589668E13DF417244274F46F5A66E1FC7D1D59BC281969BA319305BECEA119385F01CC4603439E4B37AFA2CF90645425210848A02839E3E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.270418334522813
Encrypted:	false
SSDEEP:	192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
MD5:	C4C525B081F8A0927091178F5F2EE103
SHA1:	A1F17B5EA430ADE174D02ECC0B3CB79DBF619900
SHA-256:	4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
SHA-512:	7C06E3E6261427BC6E654B2B53518C7EAA5F860A47AE8E80DC3F8F0FED91E122CB2D4632188DC44123FB759749B5425F426CD1153A8F84485EF0491002B26555
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	4.231032526864278
Encrypted:	false
SSDEEP:	384:0qcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZA21agVF:fEiqHHx4vZDV
MD5:	F9E266F763175B8F6FD4154275F8E2F0
SHA1:	8BE457700D58356BC2FA7390940611709A0E5473
SHA-256:	14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
SHA-512:	EB3E37A3C3FF8A65DEF6FA20941C8672A8197A41977E35AE2DC6551B5587B84C2703758320559F2C93C0531AD5C9D0F6C36EC5037669DC5CE78EB3367D89877B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.252429732285762
Encrypted:	false
SSDEEP:	384:J4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZGsURygUX:GEO6CHnX0vZb7
MD5:	DECF524B2D53FCD7D4FA726F00B3E5FC
SHA1:	E87C6ED4004F2772B888C5B5758AA75FE99D2F6F
SHA-256:	58F7053EE70467D3384C73F299C0DFD63EEF9744D61D1980D9D2518974CA92D4
SHA-512:	EAFF4FD80843743E61CE635FBADF4E5D9CF2C3E97F3C48350BD9E755F4423AC6867F9FE8746BD5C54E1402B18E8A55AEEF7ACA098C7CF4186DC4C1235EB35DF2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.690163963718492
Encrypted:	false
SSDEEP:	192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
MD5:	80BB1E0E06ACAF03A0B1D4EF30D14BE7
SHA1:	B20CAC0D2F3CD803D98A2E8A25FBF65884B0B619
SHA-256:	5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
SHA-512:	2A13AB6715B818AD62267AB51E55CD54714AEBF21EC9EA61C2AEFD56017DC84A6B360D024F8682A2E105582B9C5FE892ECEBD2BEF8A492279B19FFD84BC83FA5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.1215844022564285
Encrypted:	false
SSDEEP:	384:nUX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8xCkgJrAm:jNbRw8EbxwKBwbD+gLa1nh
MD5:	3727271FE04ECB6D5E49E936095E95BC
SHA1:	46182698689A849A8C210A8BF571D5F574C6F5B1
SHA-256:	3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
SHA-512:	5BED1F4DF678FE90B8E3F1B7C4F68198463E579209B079CB4A40DCAC01CE26AA2417DBE029B196F6F2C6AFAD560E2D1AF9F089ABE37EAD121CA10EE69D9659ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.293810509074883
Encrypted:	false
SSDEEP:	384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
MD5:	78AEF441C9152A17DD4DC40C7CC9DF69
SHA1:	6BB6F8426AFA6522E647DFC82B1B64FAF3A9781F
SHA-256:	56E4E4B156295F1AAA22ECB5481841DE2A9EB84845A16E12A7C18C7C3B05B707
SHA-512:	27B27E77BE81B29D42359FE28531225383860BCD19A79044090C4EA58D9F98009A254BF63585979C60B3134D47B8233941ABB354A291F23C8641A4961FA33107
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	4.862619033406922
Encrypted:	false
SSDEEP:	96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
MD5:	19E0ABF76B274C12FF624A16713F4999
SHA1:	A4B370F556B925F7126BF87F70263D1705C3A0DB
SHA-256:	D9FDA05AE16C5387AB46DC728C6EDCE6A3D0A9E1ABDD7ACB8B32FC2A17BE6F13
SHA-512:	D03033EA5CF37641FBD802EBEB5019CAEF33C9A78E01519FEA88F87E773DCA92C80B74BA80429B530694DAD0BFA3F043A7104234C7C961E18D48019D90277C8E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.227045547076371
Encrypted:	false
SSDEEP:	192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
MD5:	309D6F6B0DD022EBD9214F445CAC7BB9
SHA1:	ABD22690B7AD77782CFC0D2393D0C038E16070B0
SHA-256:	4FBE188C20FB578D4B66349D50AA6FFE4AB86844FB6427C57738F36780D1E2E2
SHA-512:	D1951FE92F83E7774E8E877815BED6E6216D56EF18B7F1C369D678CB6E1814243659E9FA7ABC0D22FB5B34A9D50A51D5A89BA00AE1FDD32157FD0FF9902FB4B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.176369829782773
Encrypted:	false
SSDEEP:	192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
MD5:	D54FEB9A270B212B0CCB1937C660678A
SHA1:	224259E5B684C7AC8D79464E51503D302390C5C9
SHA-256:	032B83F1003A796465255D9B246050A196488BAC1260F628913E536314AFDED4
SHA-512:	29955A6569CA6D039B35BB40C56AEEB75FC765600525D0B469F72C97945970A428951BAB4AF9CD21B3161D5BBA932F853778E2674CA83B14F7ABA009FA53566F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.047563322651927
Encrypted:	false
SSDEEP:	384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
MD5:	52DCD4151A9177CF685BE4DF48EA9606
SHA1:	F444A4A5CBAE9422B408420115F0D3FF973C9705
SHA-256:	D54375DC0652358A6E4E744F1A0EAEEAD87ACCD391A20D6FF324FE14E988A122
SHA-512:	64C54B89F2637759309ECC6655831C3A6755924ED70CBC51614061542EB9BA9A8AECF6951EB3AB92447247DC4D7D846C88F4957DBBE4484A9AB934343EE27178
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.09893680790018
Encrypted:	false
SSDEEP:	192:xsiXeqVb0lwbH4P01sAD7I/9hAkwDWzBEbcqgqLg:valqH4M1sAD7KvpwDFtgqLg
MD5:	F929B1A3997427191E07CF52AC883054
SHA1:	C5EA5B68586C2FB09E5FDD20D4DD616D06F5CBA6
SHA-256:	5386908173074FABD95BF269A9DF0A4E1B21C0576923186F449ABF4A820F6A8E
SHA-512:	2C79DBCE2C21214D979AB86DD989D41A3AFA7FCB7F3B79BA9974E2EE8F832DD7CA20C1C87C0C380DB037D776FE6D0851D60AD55A08AFDE0003B7E59214DD2F3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.451865349855574
Encrypted:	false
SSDEEP:	384:KfwogDHER1wuiDSyoGTgDZOviNgEPrLg:ugDHELwuiDScTgDwi+EP
MD5:	1FA5E257A85D16E916E9C22984412871
SHA1:	1AC8EE98AD0A715A1B40AD25D2E8007CDC19871F
SHA-256:	D87A9B7CAD4C451D916B399B19298DC46AAACC085833C0793092641C00334B8E
SHA-512:	E4205355B647C6E28B7E4722328F51DC2EB3A109E9D9B90F7C53D7A80A5A4B10E40ABDDAB1BA151E73EF3EB56941F843535663F42DCE264830E6E17BB659EADF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.104245335186531
Encrypted:	false
SSDEEP:	192:3F/1n7Guqaj0kt7/Ev9kt0Qwac6QzD8iD0QocqgI4G0S:nGXkd/EvGt9wacNDvAgI4v
MD5:	FAD578A026F280C1AE6F787B1FA30129
SHA1:	9A3E93818A104314E172A304C3D117B6A66BEB55
SHA-256:	74A1FF0801F4704158684267CD8E123F83FB6334FE522C1890AC4A0926F80AB1
SHA-512:	ACF8F5B382F3B4C07386505BBDCAF625D13BCC10AA93ED641833E3548261B0AD1063E2F59BE2FCD2AFAF3D315CB3FC5EB629CEFC168B33CFD65A3A6F1120F7FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.671305741258107
Encrypted:	false
SSDEEP:	384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
MD5:	556E6D0E5F8E4DA74C2780481105D543
SHA1:	7A49CDEF738E9FE9CD6CD62B0F74EAD1A1774A33
SHA-256:	247B0885CF83375211861F37B6DD1376AED5131D621EE0137A60FE7910E40F8B
SHA-512:	28FA0CE6BDBCC5E95B80AADC284C12658EF0C2BE63421AF5627776A55050EE0EA0345E30A15B744FC2B2F5B1B1BBB61E4881F27F6E3E863EBAAEED1073F4CDA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h..9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ...............P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.878701941774916
Encrypted:	false
SSDEEP:	384:EJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1OhgkxEv:EcIRnHX1P/YtswvaD1Rk
MD5:	2F2655A7BBFE08D43013EDDA27E77904
SHA1:	33D51B6C423E094BE3E34E5621E175329A0C0914
SHA-256:	C734ABBD95EC120CB315C43021C0E1EB1BF2295AF9F1C24587334C3FCE4A5BE1
SHA-512:	8AF99ACC969B0E560022F75A0CDCAA85D0BDEADADEACD59DD0C4500F94A5843EA0D4107789C1A613181B1F4E5252134A485EF6B1D9D83CDB5676C5FEE4D49B90
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.881781476285865
Encrypted:	false
SSDEEP:	384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
MD5:	CDE035B8AB3D046B1CE37EEE7EE91FA0
SHA1:	4298B62ED67C8D4F731D1B33E68D7DC9A58487FF
SHA-256:	16BEA322D994A553B293A724B57293D57DA62BC7EAF41F287956B306C13FD972
SHA-512:	C44FDEE5A210459CE4557351E56B2D357FD4937F8EC8EACEAB842FEE29761F66C2262FCBAAC837F39C859C67FA0E23D13E0F60B3AE59BE29EB9D8ABAB0A572BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.837887867708438
Encrypted:	false
SSDEEP:	768:e839Cc4itui0gel9soFdkO66MlPGXmXcyYDTzks:Ns4u/FZ6nPxMLDvk
MD5:	999D431197D7E06A30E0810F1F910B9A
SHA1:	9BFF781221BCFFD8E55485A08627EC2A37363C96
SHA-256:	AB242B9C9FB662C6F7CB57F7648F33983D6FA3BB0683C5D4329EC2CC51E8C875
SHA-512:	A5DD92DD471ADB44EEFE5919EF9CA3978724E21174DF5B3A9C1F0AB462F928E5A46A460D02417DB7522F5DE3BFEED5EEE6B1EAFAF3E621722E85E72675F7096F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.895310340516013
Encrypted:	false
SSDEEP:	768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
MD5:	0931ABBF3AED459B1A2138B551B1D3BB
SHA1:	9EC0296DDAF574A89766A2EC035FC30073863AB0
SHA-256:	1729A0DC6B80CB7A3C07372B98B10D3C6C613EA645240878E1FDE6A992FA06F1
SHA-512:	9F970BB4D10B94F525DDDDE307C7DA5E672BBFB3A3866A34B89B56ADA99476724FD690A4396857182749294F67F36DB471A048789FB715D2A7DAF46917FC1947
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.967737129255606
Encrypted:	false
SSDEEP:	192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
MD5:	5F057A380BACBA4EF59C0611549C0E02
SHA1:	4B758D18372D71F0AA38075F073722A55B897F71
SHA-256:	BCB14DAC6C87C24269D3E60C46B49EFFB1360F714C353318F5BBAA48C79EC290
SHA-512:	E1C99E224745B86EE55822C1DBCB4555A11EC31B72D87B46514917EB61E0258A1C6D38C4F592969C17EB4F0F74DA04BCECA31CF1622720E95F0F20E9631792E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.007867576025166
Encrypted:	false
SSDEEP:	192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
MD5:	49BCA1B7DF076D1A550EE1B7ED3BD997
SHA1:	47609C7102F5B1BCA16C6BAD4AE22CE0B8AEE9E9
SHA-256:	49E15461DCB76690139E71E9359F7FCF92269DCCA78E3BFE9ACB90C6271080B2
SHA-512:	8574D7FA133B72A4A8D1D7D9FDB61053BC88C2D238B7AC7D519BE19972B658C44EA1DE433885E3206927C75DD5D1028F74999E048AB73189585B87630F865466
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.226023387740053
Encrypted:	false
SSDEEP:	384:rfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDiYIgovg:mcHfRl5pauoSjy5DiE
MD5:	CB5CFDD4241060E99118DEEC6C931CCC
SHA1:	1E7FED96CF26C9F4730A4621CA9D18CECE3E0BCE
SHA-256:	A8F809B6A417AF99B75EEEEA3ECD16BDA153CBDA4FFAB6E35CE1E8C884D899C4
SHA-512:	8A89E3563C14B81353D251F9F019D8CBF07CB98F78452B8522413C7478A0D77B9ABF2134E4438145D6363CDA39721D2BAE8AD13D1CDACCBB5026619D95F931CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.262055670423592
Encrypted:	false
SSDEEP:	192:C/ZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cD66WGcqgFjLg:vI4IHHaQfSVnCZyDImgFjLg
MD5:	18D2D96980802189B23893820714DA90
SHA1:	5DEE494D25EB79038CBC2803163E2EF69E68274C
SHA-256:	C2FD98C677436260ACB9147766258CB99780A007114AED37C87893DF1CF1A717
SHA-512:	0317B65D8F292332C5457A6B15A77548BE5B2705F34BB8F4415046E3E778580ABD17B233E6CC2755C991247E0E65B27B5634465646715657B246483817CACEB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..\|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..\|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.913843738203007
Encrypted:	false
SSDEEP:	384:dspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSq:7Y44UagH6cAFCLUSYpMg3YDzPo5kG9G
MD5:	EF472BA63FD22922CA704B1E7B95A29E
SHA1:	700B68E7EF95514D5E94D3C6B10884E1E187ACD8
SHA-256:	66EEF4E6E0CEEEF2C23A758BFBEDAE7C16282FC93D0A56ACAFC40E871AC3F01C
SHA-512:	DC2060531C4153C43ABF30843BCB5F8FA082345CA1BB57F9AC8695EDDB28FF9FDA8132B6B6C67260F779D95FCADCAE2811091BCA300AB1E041FAE6CC7B50ABD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...^..f.........." .....`...0......`.....................................................`..........................................~..\|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.735350805948923
Encrypted:	false
SSDEEP:	192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
MD5:	3B1CE70B0193B02C437678F13A335932
SHA1:	063BFD5A32441ED883409AAD17285CE405977D1F
SHA-256:	EB2950B6A2185E87C5318B55132DFE5774A5A579259AB50A7935A7FB143EA7B1
SHA-512:	0E02187F17DFCFD323F2F0E62FBFE35F326DCF9F119FC8B15066AFAEEE4EB7078184BC85D571B555E9E67A2DD909EC12D8A67E3D075E9B1283813EF274E05C0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_curve25519.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.705606408072877
Encrypted:	false
SSDEEP:	384:19BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDEFSegqrA:NcRy38J+9dmvufFtaGDV
MD5:	FF33C306434DEC51D39C7BF1663E25DA
SHA1:	665FCF47501F1481534597C1EAC2A52886EF0526
SHA-256:	D0E3B6A2D0E073B2D9F0FCDB051727007943A17A4CA966D75EBA37BECDBA6152
SHA-512:	66A909DC9C3B7BD4050AA507CD89B0B3A661C85D33C881522EC9568744953B698722C1CBFF093F9CBCD6119BD527FECAB05A67F2E32EC479BE47AFFA4377362C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_curve448.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	6.0189903352673655
Encrypted:	false
SSDEEP:	1536:Jfju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXOa:pXRMgWiEDZiECgd/iwOXUQdbhov0ClbU
MD5:	F267BF4256F4105DAD0D3E59023011ED
SHA1:	9BC6CA0F375CE49D5787C909D290C07302F58DA6
SHA-256:	1DDE8BE64164FF96B2BAB88291042EB39197D118422BEE56EB2846E7A2D2F010
SHA-512:	A335AF4DBF1658556ED5DC13EE741419446F7DAEC6BD2688B626A803FA5DD76463D6367C224E0B79B17193735E2C74BA417C26822DAEEF05AC3BAB1588E2DE83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...\..f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770560
Entropy (8bit):	7.613224993327352
Encrypted:	false
SSDEEP:	12288:XtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:XtIrHoxJFf1p34hcrn5Go9yQO6
MD5:	1EFD7F7CB1C277416011DE6F09C355AF
SHA1:	C0F97652AC2703C325AB9F20826A6F84C63532F2
SHA-256:	AB45FA80A68DB1635D41DC1A4AAD980E6716DAC8C1778CB5F30CDB013B7DF6E6
SHA-512:	2EC4B88A1957733043BBD63CEAA6F5643D446DB607B3267FAD1EC611E6B0AF697056598AAC2AE5D44AB2B9396811D183C32BCE5A0FF34E583193A417D1C5226B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.8551858881598795
Encrypted:	false
SSDEEP:	384:BczadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2pRQNgQQ77k:2udRf2MuMJ+9dmv8aea34taLDcfQ
MD5:	C5FB377F736ED731B5578F57BB765F7A
SHA1:	5BA51E11F4DE1CAEDEBA0F7D4D10EC62EC109E01
SHA-256:	32073DF3D5C85ABCE7D370D6E341EF163A8350F6A9EDC775C39A23856CCFDD53
SHA-512:	D361BCDAF2C700D5A4AC956D96E00961432C05A1B692FC870DB53A90F233A6D24AA0C3BE99E40BD8E5B7C6C1B2BCDCDCFC545292EF321486FFC71C5EA7203E6A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	6.064677498000638
Encrypted:	false
SSDEEP:	1536:BrYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKW:Br4vxcZeLrIeN1TvHsuP45yAqVDK9ag3
MD5:	8A0C0AA820E98E83AC9B665A9FD19EAF
SHA1:	6BF5A14E94D81A55A164339F60927D5BF1BAD5C4
SHA-256:	4EE3D122DCFFE78E6E7E76EE04C38D3DC6A066E522EE9F7AF34A09649A3628B1
SHA-512:	52496AE7439458DEDB58A65DF9FFDCC3A7F31FC36FE7202FB43570F9BB03ABC0565F5EF32E5E6C048ED3EBC33018C19712E58FF43806119B2FB5918612299E7E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...^..f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.675380950473425
Encrypted:	false
SSDEEP:	96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
MD5:	44B930B89CE905DB4716A548C3DB8DEE
SHA1:	948CBFF12A243C8D17A7ACD3C632EE232DF0F0ED
SHA-256:	921C2D55179C0968535B20E9FD7AF55AD29F4CE4CF87A90FE258C257E2673AA5
SHA-512:	79DF755BE8B01D576557A4CB3F3200E5EE1EDE21809047ABB9FF8D578C535AC1EA0277EDA97109839A7607AF043019F2C297E767441C7E11F81FDC87FD1B6EFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................@'..\|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.625428549874022
Encrypted:	false
SSDEEP:	96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
MD5:	F24F9356A6BDD29B9EF67509A8BC3A96
SHA1:	A26946E938304B4E993872C6721EB8CC1DCBE43B
SHA-256:	034BB8EFE3068763D32C404C178BD88099192C707A36F5351F7FDB63249C7F81
SHA-512:	C4D3F92D7558BE1A714388C72F5992165DD7A9E1B4FA83B882536030542D93FDAD9148C981F76FFF7868192B301AC9256EDB8C3D5CE5A1A2ACAC183F96C1028B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84760
Entropy (8bit):	6.58578024183428
Encrypted:	false
SSDEEP:	1536:ES7z7Sj2u5ia5ifC83zYLzbCK8CkotIpCVF7SyTUxIS:/7z+jw3MzCNCkotIpCVF+
MD5:	90F58F625A6655F80C35532A087A0319
SHA1:	D4A7834201BD796DC786B0EB923F8EC5D60F719B
SHA-256:	BD8621FCC901FA1DE3961D93184F61EA71068C436794AF2A4449738CCF949946
SHA-512:	B5BB1ECC195700AD7BEA5B025503EDD3770B1F845F9BEEE4B067235C4E63496D6E0B19BDD2A42A1B6591D1131A2DC9F627B2AE8036E294300BB6983ECD644DC8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R...S..R.....R...W..R...V..R...Q..R...S..R..S..R..S..R..._..R...R..R......R...P..R.Rich.R.........................PE..d....Are.........." ...%.....^......\|........................................P............`.............................................H............0....... ..,......../...@..........T...........................p...@............................................text...k........................... ..`.rdata..p>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125208
Entropy (8bit):	6.126925801052556
Encrypted:	false
SSDEEP:	3072:PGTMA4TPG40srrYLGNyf/ECZGKgyWLRECBIpLPIuE:Otgp0swLvf/EKCkE
MD5:	452305C8C5FDA12F082834C3120DB10A
SHA1:	9BAB7B3FD85B3C0F2BEDC3C5ADB68B2579DAA6E7
SHA-256:	543CE9D6DC3693362271A2C6E7D7FC07AD75327E0B0322301DD29886467B0B0E
SHA-512:	3D52AFDBC8DA74262475ABC8F81415A0C368BE70DBF5B2BD87C9C29CA3D14C44770A5B8B2E7C082F3ECE0FD2BA1F98348A04B106A48D479FA6BD062712BE8F7C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......x...<...<...<...5.*.:...)...>...)...0...)...4...)...8.......>...w...=...w...:.......?...<..........:.......=.....F.=.......=...Rich<...........................PE..d....Are.........." ...%............`_....................................................`.........................................``.......`.........................../......p.......T...............................@............................................text............................... ..`.rdata..Xl.......n..................@..@.data....4.......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	253208
Entropy (8bit):	6.560002521238215
Encrypted:	false
SSDEEP:	6144:kgd/2mZLgPFIY9qWM53pLW1AepppzoeteKU:JZLgPykeKU
MD5:	F78F9855D2A7CA940B6BE51D68B80BF2
SHA1:	FD8AF3DBD7B0EA3DE2274517C74186CB7CD81A05
SHA-256:	D4AE192BBD4627FC9487A2C1CD9869D1B461C20CFD338194E87F5CF882BBED12
SHA-512:	6B68C434A6F8C436D890D3C1229D332BD878E5777C421799F84D79679E998B95D2D4A013B09F50C5DE4C6A85FCCEB796F3C486E36A10CBAC509A0DA8D8102B18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mBP\.,.\.,.\.,.Ut..R.,.Is-.^.,.Is).Q.,.Is(.T.,.Is/.X.,.f.-._.,..t-.^.,.\.-...,.f./.].,.f.!.S.,.f.,.].,.f...].,.f...].,.Rich\.,.........PE..d....Are.........." ...%.v...<......L....................................................`..........................................T..P...@U..................x'......./......P.......T...........................`...@............................................text...-t.......v.................. ..`.rdata..D............z..............@..@.data....*...p...$...R..............@....pdata..x'.......(...v..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65816
Entropy (8bit):	6.242721496157571
Encrypted:	false
SSDEEP:	1536:uElYij3wzR1lBafLEmIRhFIpOIi7SyHqxn:zYdBaTEmghFIpOIiu
MD5:	8BAEB2BD6E52BA38F445EF71EF43A6B8
SHA1:	4132F9CD06343EF8B5B60DC8A62BE049AA3270C2
SHA-256:	6C50C9801A5CAF0BB52B384F9A0D5A4AA182CA835F293A39E8999CF6EDF2F087
SHA-512:	804A4E19EA622646CEA9E0F8C1E284B7F2D02F3620199FA6930DBDADC654FA137C1E12757F87C3A1A71CEFF9244AA2F598EE70D345469CA32A0400563FE3AA65
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Aj...j...j...c.C.n.......h.......f.......b.......i...Pa..h...!...h.......i...j.......Pa..k...Pa..k...Pa/.k...Pa..k...Richj...........................PE..d....Are.........." ...%.T..........P@..............................................oE....`.............................................P.............................../......X...@}..T............................\|..@............p..(............................text....S.......T.................. ..`.rdata..&O...p...P...X..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159512
Entropy (8bit):	6.8453439550985475
Encrypted:	false
SSDEEP:	3072:kEVLLSVeexIDteznfV9mNoNMuX4mZp7zuNtIpZ1uV:kEVHbeye9YON1buNN
MD5:	CF8DE1137F36141AFD9FF7C52A3264EE
SHA1:	AFDE95A1D7A545D913387624EF48C60F23CF4A3F
SHA-256:	22D10E2D6AD3E3ED3C49EB79AB69A81AAA9D16AECA7F948DA2FE80877F106C16
SHA-512:	821985FF5BC421BD16B2FA5F77F1F4BF8472D0D1564BC5768E4DBE866EC52865A98356BB3EF23A380058ACD0A25CD5A40A1E0DAE479F15863E48C4482C89A03F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RH:..)T..)T..)T..Q...)T..VU..)T..VQ..)T..VP..)T..VW..)T.,.U..)T.]QU..)T..)U.s)T.,.Y.,)T.,.T..)T.,....)T.,.V..)T.Rich.)T.........PE..d... Bre.........." ...%.d...........6....................................................`..........................................%..L...\%..x....p.......P.......@.../......4.......T...........................p...@............................................text....b.......d.................. ..`.rdata..............h..............@..@.data...(....@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35096
Entropy (8bit):	6.462269556682856
Encrypted:	false
SSDEEP:	768:sgYvrenSE0PcxxQ0zi+m1IpWtz5YiSyvyAMxkEs1:JYTQSCxQ0zlm1IpWt97Sy4xu
MD5:	C0A06AEBBD57D2420037162FA5A3142B
SHA1:	1D82BA750128EB51070CDEB0C69AC75117E53B43
SHA-256:	5673B594E70D1FDAAD3895FC8C3676252B7B675656FB88EF3410BC93BB0E7687
SHA-512:	DDF2C4D22B2371A8602601A05418EF712E03DEF66E2D8E8814853CDD989ED457EFBD6032F4A4A3E9ECCA9915D99C249DFD672670046461A9FE510A94DA085FBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........*..y..y..y..y..y...x..y...x..y...x..y...x..y.J.x..y..y..y...x..y.J.x..y.J.x..y.Jky..y.J.x..yRich..y................PE..d....Are.........." ...%.....>......P...............................................\|w....`.........................................0E..`....E..x............p.......Z.../...........4..T............................3..@............0...............................text............................... ..`.rdata..r ...0..."..."..............@..@.data........`.......D..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32536
Entropy (8bit):	6.46409711645548
Encrypted:	false
SSDEEP:	768:0k+Eq6rf65MoJ/MBIpQUh5YiSyv/AMxkEG:55fhoJEBIpQUP7SynxC
MD5:	5AA4B057BA2331EED6B4B30F4B3E0D52
SHA1:	6B9DB113C2882743984C3D8B70EC49FC4A136C23
SHA-256:	D43DCA0E00C3C11329B68177E967CF5240495C4786F5AFA76AC4F267C3A5CDB9
SHA-512:	AA5AA3285EA5C177ECA055949C5F550DBD2D2699202A29EFE2077213CBC95FFF2A36D99EECCE249AC04D95BAF149B3D8C557A67FC39EAD3229F0B329E83447B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.\.Sa..Sa..Sa..+...Sa..,`..Sa..,d..Sa..,e..Sa..,b..Sa.$.`..Sa.U+`..Sa..S`.USa.$.l..Sa.$.a..Sa.$...Sa.$.c..Sa.Rich.Sa.........PE..d....Are.........." ...%.....8......................................................[%....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..8............................text............................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83224
Entropy (8bit):	6.336611500173631
Encrypted:	false
SSDEEP:	1536:MUuhDLiJvz76Hl+ZWly+uC69/s+S+pzcHst8/n1IsJHO7sBIpLwfB7SysaZx7:MU6DL4vHAy+uC69/sT+pzus81IwHO7sl
MD5:	439B3AD279BEFA65BB40ECEBDDD6228B
SHA1:	D3EA91AE7CAD9E1EBEC11C5D0517132BBC14491E
SHA-256:	24017D664AF20EE3B89514539345CAAC83ECA34825FCF066A23E8A4C99F73E6D
SHA-512:	A335E1963BB21B34B21AEF6B0B14BA8908A5343B88F65294618E029E3D4D0143EA978A5FD76D2DF13A918FFAB1E2D7143F5A1A91A35E0CC1145809B15AF273BD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|../8z.\|8z.\|8z.\|1.T\|>z.\|-..}:z.\|-..}5z.\|-..}0z.\|-..};z.\|...}:z.\|8z.\|.z.\|s..}1z.\|...}9z.\|...}9z.\|..8\|9z.\|...}9z.\|Rich8z.\|........PE..d....Bre.........." ...%.v...........-.......................................`............`.............................................P............@.......0.........../...P..........T...............................@............................................text....u.......v.................. ..`.rdata...x.......z...z..............@..@.data...H...........................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	177432
Entropy (8bit):	5.976278188413444
Encrypted:	false
SSDEEP:	3072:ECRW4ljuyKK8vZktW5NP6Xf9N54eNWXvM4VRJNI7IM/cbP7RHs3FJZtIpC7f6:EmfEyKKaZP6Xf92MSV+JZM
MD5:	6774D6FB8B9E7025254148DC32C49F47
SHA1:	212E232DA95EC8473EB0304CF89A5BAF29020137
SHA-256:	2B6F1B1AC47CB7878B62E8D6BB587052F86CA8145B05A261E855305B9CA3D36C
SHA-512:	5D9247DCE96599160045962AF86FC9E5439F66A7E8D15D1D00726EC1B3B49D9DD172D667380D644D05CB18E45A5419C2594B4BCF5A16EA01542AE4D7D9A05C6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........._..............V......................................f......e...........-............f.......f.......f:......f......Rich....................PE..d...#Bre.........." ...%............\,...............................................t....`......................................... ...d.......................8......../......x...@...T...............................@............................................text.............................. ..`.rdata...!......."..................@..@.data...(...........................@....pdata..8............^..............@..@.rsrc................j..............@..@.reloc..x............t..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36632
Entropy (8bit):	6.358330339853201
Encrypted:	false
SSDEEP:	768:6RxnHG7MYGQd0fmdzA77yeutIpCiq5YiSyvtGAMxkENy:6Rxnm7M6dKmdzA77yeutIpCio7SyCxZy
MD5:	CB0564BC74258CB1320C606917CE5A71
SHA1:	5B2BFC0D997CC5B7D985BFADDDBFC180CB01F7CF
SHA-256:	0342916A60A7B39BBD5753D85E1C12A4D6F990499753D467018B21CEFA49CF32
SHA-512:	43F3AFA9801FCF5574A30F4D3E7AE6AFF65C7716462F9ABA5BC8055887A44BF38FBA121639D8B31427E738752FE3B085D1D924DE2633F4C042433E1960023F38
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S..............l..............................z.......................................z.......z.......z.......z......Rich....................PE..d....Are.........." ...%.(...:.......&..............................................N.....`..........................................T..H....T...............p..`....`.../......t...DG..T............................C..@............@.......S..@....................text....&.......(.................. ..`.rdata..D....@... ...,..............@..@.data........`.......L..............@....pdata..`....p.......P..............@..@.rsrc................T..............@..@.reloc..t............^..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.608323768366966
Encrypted:	false
SSDEEP:	192:KFOWWthWzWf9BvVVWQ4mWqyVT/gqnajKsrCS81:uZWthWeN01IlGsrCt
MD5:	07EBE4D5CEF3301CCF07430F4C3E32D8
SHA1:	3B878B2B2720915773F16DBA6D493DAB0680AC5F
SHA-256:	8F8B79150E850ACC92FD6AAB614F6E3759BEA875134A62087D5DD65581E3001F
SHA-512:	6C7E4DF62EBAE9934B698F231CF51F54743CF3303CD758573D00F872B8ECC2AF1F556B094503AAE91100189C0D0A93EAF1B7CAFEC677F384A1D7B4FDA2EEE598
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0............`A........................................p...,............ ...................!..............p............................................................................rdata..d...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11736
Entropy (8bit):	6.6074868843808785
Encrypted:	false
SSDEEP:	192:PUWthW6Wf9BvVVWQ4SWZifvXqnajJ6HNbLet:MWthW3NhXll6HZm
MD5:	557405C47613DE66B111D0E2B01F2FDB
SHA1:	DE116ED5DE1FFAA900732709E5E4EEF921EAD63C
SHA-256:	913EAAA7997A6AEE53574CFFB83F9C9C1700B1D8B46744A5E12D76A1E53376FD
SHA-512:	C2B326F555B2B7ACB7849402AC85922880105857C616EF98F7FB4BBBDC2CD7F2AF010F4A747875646FCC272AB8AA4CE290B6E09A9896CE1587E638502BD4BEFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...p.~..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..H...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.622854484071805
Encrypted:	false
SSDEEP:	192:tlWthWFWf9BvVVWQ4mWIzWLiP+CjAWqnajKsNb7:/WthWANnWLiP+CcWlGsNb7
MD5:	624401F31A706B1AE2245EB19264DC7F
SHA1:	8D9DEF3750C18DDFC044D5568E3406D5D0FB9285
SHA-256:	58A8D69DF60ECBEE776CD9A74B2A32B14BF2B0BD92D527EC5F19502A0D3EB8E9
SHA-512:	3353734B556D6EEBC57734827450CE3B34D010E0C033E95A6E60800C0FDA79A1958EBF9053F12054026525D95D24EEC541633186F00F162475CEC19F07A0D817
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...YJ..........." .........................................................0.......s....`A........................................p................ ...................!..............p............................................................................rdata..T...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.670771733256744
Encrypted:	false
SSDEEP:	192:1mxD3+HWthWiWf9BvVVWQ4WWuhD7DiqnajKswz3:19HWthWfN/GlGswz3
MD5:	2DB5666D3600A4ABCE86BE0099C6B881
SHA1:	63D5DDA4CEC0076884BC678C691BDD2A4FA1D906
SHA-256:	46079C0A1B660FC187AAFD760707F369D0B60D424D878C57685545A3FCE95819
SHA-512:	7C6E1E022DB4217A85A4012C8E4DAEE0A0F987E4FBA8A4C952424EF28E250BAC38B088C242D72B4641157B7CC882161AEFA177765A2E23AFCDC627188A084345
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....^[..........." .........................................................0......@^....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15328
Entropy (8bit):	6.561472518225768
Encrypted:	false
SSDEEP:	192:RaNYPvVX8rFTsoWthWgWf9BvVVWQ4SWfMaPOoI80Hy5qnajslBE87QyX:HPvVXqWthWlN2WlslEE87Qw
MD5:	0F7D418C05128246AFA335A1FB400CB9
SHA1:	F6313E371ED5A1DFFE35815CC5D25981184D0368
SHA-256:	5C9BC70586AD538B0DF1FCF5D6F1F3527450AE16935AA34BD7EB494B4F1B2DB9
SHA-512:	7555D9D3311C8622DF6782748C2186A3738C4807FC58DF2F75E539729FC4069DB23739F391950303F12E0D25DF9F065B4C52E13B2EBB6D417CA4C12CFDECA631
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...*.;A.........." .........................................................@.......m....`A........................................p................0...................!..............p............................................................................rdata..<...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.638884356866373
Encrypted:	false
SSDEEP:	192:jlWaWthWAWf9BvVVWQ4WWloprVP+CjAWqnajKsNWqL:jIaWthWFNxtVP+CcWlGsNxL
MD5:	5A72A803DF2B425D5AAFF21F0F064011
SHA1:	4B31963D981C07A7AB2A0D1A706067C539C55EC5
SHA-256:	629E52BA4E2DCA91B10EF7729A1722888E01284EED7DDA6030D0A1EC46C94086
SHA-512:	BF44997C405C2BA80100EB0F2FF7304938FC69E4D7AE3EAC52B3C236C3188E80C9F18BDA226B5F4FDE0112320E74C198AD985F9FFD7CEA99ACA22980C39C7F69
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...=+vj.........." .........................................................0.......N....`A........................................p...L............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11744
Entropy (8bit):	6.744400973311854
Encrypted:	false
SSDEEP:	96:imdzvQzEWthWwMVDEs3f0DHDsVBIwgmqvrnDD0ADEs3TDL2L4m2grMWaLN5DEs3r:v3WthWyWf9BvVVWQ4SWVVFJqqnajW2y
MD5:	721B60B85094851C06D572F0BD5D88CD
SHA1:	4D0EE4D717AEB9C35DA8621A545D3E2B9F19B4E7
SHA-256:	DAC867476CAA42FF8DF8F5DFE869FFD56A18DADEE17D47889AFB69ED6519AFBF
SHA-512:	430A91FCECDE4C8CC4AC7EB9B4C6619243AB244EE88C34C9E93CA918E54BD42B08ACA8EA4475D4C0F5FA95241E4AACB3206CBAE863E92D15528C8E7C9F45601B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......T`....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11736
Entropy (8bit):	6.638488013343178
Encrypted:	false
SSDEEP:	192:frWthWFWf9BvVVWQ4SWNOfvXqnajJ6H4WJ:frWthWANRXll6H4WJ
MD5:	D1DF480505F2D23C0B5C53DF2E0E2A1A
SHA1:	207DB9568AFD273E864B05C87282987E7E81D0BA
SHA-256:	0B3DFB8554EAD94D5DA7859A12DB353942406F9D1DFE3FAC3D48663C233EA99D
SHA-512:	F14239420F5DD84A15FF5FCA2FAD81D0AA9280C566FA581122A018E10EBDF308AC0BF1D3FCFC08634C1058C395C767130C5ABCA55540295C68DF24FFD931CA0A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....(..........." .........................................................0......;.....`A........................................p...`............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12256
Entropy (8bit):	6.588267640761022
Encrypted:	false
SSDEEP:	192:txlkWthW2Wf9BvVVWQ4SWBBBuUgxfzfqnaj0OTWv:txlkWthW7NkIrloFv
MD5:	73433EBFC9A47ED16EA544DDD308EAF8
SHA1:	AC1DA1378DD79762C6619C9A63FD1EBE4D360C6F
SHA-256:	C43075B1D2386A8A262DE628C93A65350E52EAE82582B27F879708364B978E29
SHA-512:	1C28CC0D3D02D4C308A86E9D0BC2DA88333DFA8C92305EC706F3E389F7BB6D15053040AFD1C4F0AA3383F3549495343A537D09FE882DB6ED12B7507115E5A263
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....pi..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..<...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.678828474114903
Encrypted:	false
SSDEEP:	192:4TWthWckWf9BvVVWQ4mWQAyUD7DiqnajKswzjdg:4TWthWcRNqGlGswzji
MD5:	7C7B61FFA29209B13D2506418746780B
SHA1:	08F3A819B5229734D98D58291BE4BFA0BEC8F761
SHA-256:	C23FE8D5C3CA89189D11EC8DF983CC144D168CB54D9EAB5D9532767BCB2F1FA3
SHA-512:	6E5E3485D980E7E2824665CBFE4F1619B3E61CE3BCBF103979532E2B1C3D22C89F65BCFBDDBB5FE88CDDD096F8FD72D498E8EE35C3C2307BACECC6DEBBC1C97F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....\|............" .........................................................0.......3....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.602852377056617
Encrypted:	false
SSDEEP:	192:Us13vuBL3B5LoWthW7Wf9BvVVWQ4mWgB7OQP+CjAWqnajKsN9arO:Us13vuBL3B2WthWmNVXP+CcWlGsN9P
MD5:	6D0550D3A64BD3FD1D1B739133EFB133
SHA1:	C7596FDE7EA1C676F0CC679CED8BA810D15A4AFE
SHA-256:	F320F9C0463DE641B396CE7561AF995DE32211E144407828B117088CF289DF91
SHA-512:	5DA9D490EF54A1129C94CE51349399B9012FC0D4B575AE6C9F1BAFCFCF7F65266F797C539489F882D4AD924C94428B72F5137009A851ECB541FE7FB9DE12FEB2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...]. ,.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..X...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14800
Entropy (8bit):	6.528059454770997
Encrypted:	false
SSDEEP:	384:On2OMw3zdp3bwjGfue9/0jCRrndbZWWthWdNHhfVlGsSH:/OMwBprwjGfue9/0jCRrndbLEKv
MD5:	1ED0B196AB58EDB58FCF84E1739C63CE
SHA1:	AC7D6C77629BDEE1DF7E380CC9559E09D51D75B7
SHA-256:	8664222823E122FCA724620FD8B72187FC5336C737D891D3CEF85F4F533B8DE2
SHA-512:	E1FA7F14F39C97AAA3104F3E13098626B5F7CFD665BA52DCB2312A329639AAF5083A9177E4686D11C4213E28ACC40E2C027988074B6CC13C5016D5C5E9EF897B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...w............" .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.659218747104705
Encrypted:	false
SSDEEP:	192:2E+tWthWvWf9BvVVWQ4mWxHD7DiqnajKswzGIAf:T+tWthWiNcGlGswzLAf
MD5:	721BAEA26A27134792C5CCC613F212B2
SHA1:	2A27DCD2436DF656A8264A949D9CE00EAB4E35E8
SHA-256:	5D9767D8CCA0FBFD5801BFF2E0C2ADDDD1BAAAA8175543625609ABCE1A9257BD
SHA-512:	9FD6058407AA95058ED2FDA9D391B7A35FA99395EC719B83C5116E91C9B448A6D853ECC731D0BDF448D1436382EECC1FA9101F73FA242D826CC13C4FD881D9BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...,OT..........." .........................................................0...........`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.739082809754283
Encrypted:	false
SSDEEP:	192:vdWthW8Wf9BvVVWQ4mWG2P+CjAWqnajKsNt:lWthWJNUP+CcWlGsNt
MD5:	B3F887142F40CB176B59E58458F8C46D
SHA1:	A05948ABA6F58EB99BBAC54FA3ED0338D40CBFAD
SHA-256:	8E015CDF2561450ED9A0773BE1159463163C19EAB2B6976155117D16C36519DA
SHA-512:	7B762319EC58E3FCB84B215AE142699B766FA9D5A26E1A727572EE6ED4F5D19C859EFB568C0268846B4AA5506422D6DD9B4854DA2C9B419BFEC754F547203F7E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...X.j..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.601112204637961
Encrypted:	false
SSDEEP:	192:GFPWthW5Wf9BvVVWQ4mWc0ZD7DiqnajKswzczr:GFPWthWsNiGlGswzq
MD5:	89F35CB1212A1FD8FBE960795C92D6E8
SHA1:	061AE273A75324885DD098EE1FF4246A97E1E60C
SHA-256:	058EB7CE88C22D2FF7D3E61E6593CA4E3D6DF449F984BF251D9432665E1517D1
SHA-512:	F9E81F1FEAB1535128B16E9FF389BD3DAAAB8D1DABF64270F9E563BE9D370C023DE5D5306DD0DE6D27A5A099E7C073D17499442F058EC1D20B9D37F56BCFE6D2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...ig............" .........................................................0......H.....`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14288
Entropy (8bit):	6.521808801015781
Encrypted:	false
SSDEEP:	192:/uUk1Jzb9cKcIzWthWzaWf9BvVVWQ4mWmrcLUVT/gqnajKsrCOV:/bk1JzBcKcIzWthWzXNz1IlGsrCOV
MD5:	0C933A4B3C2FCF1F805EDD849428C732
SHA1:	B8B19318DBB1D2B7D262527ABD1468D099DE3FB6
SHA-256:	A5B733E3DCE21AB62BD4010F151B3578C6F1246DA4A96D51AC60817865648DD3
SHA-512:	B25ED54345A5B14E06AA9DADD07B465C14C23225023D7225E04FBD8A439E184A7D43AB40DF80E3F8A3C0F2D5C7A79B402DDC6B9093D0D798E612F4406284E39D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....U..........." .........................................................0......Y.....`A........................................p................ ...................!..............p............................................................................rdata..4...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.671157737548847
Encrypted:	false
SSDEEP:	192:7oDfIeVWthWZWf9BvVVWQ4mWaHvP+CjAWqnajKsNZ:7oDfIeVWthWMNVP+CcWlGsNZ
MD5:	7E8B61D27A9D04E28D4DAE0BFA0902ED
SHA1:	861A7B31022915F26FB49C79AC357C65782C9F4B
SHA-256:	1EF06C600C451E66E744B2CA356B7F4B7B88BA2F52EC7795858D21525848AC8C
SHA-512:	1C5B35026937B45BEB76CB8D79334A306342C57A8E36CC15D633458582FC8F7D9AB70ACE7A92144288C6C017F33ECFC20477A04432619B40A21C9CDA8D249F6D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......N.....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.599056003106114
Encrypted:	false
SSDEEP:	192:gR7WthWTVWf9BvVVWQ4mWg2a5P+CjAWqnajKsNQbWl:gVWthWkN/P+CcWlGsNMg
MD5:	8D12FFD920314B71F2C32614CC124FEC
SHA1:	251A98F2C75C2E25FFD0580F90657A3EA7895F30
SHA-256:	E63550608DD58040304EA85367E9E0722038BA8E7DC7BF9D91C4D84F0EC65887
SHA-512:	5084C739D7DE465A9A78BCDBB8A3BD063B84A68DCFD3C9EF1BFA224C1CC06580E2A2523FD4696CFC48E9FD068A2C44DBC794DD9BDB43DC74B4E854C82ECD3EA5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....X4.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.602527553095181
Encrypted:	false
SSDEEP:	192:zGeVfcWthW+Wf9BvVVWQ4mWMiSID7DiqnajKswz5g:zGeVfcWthWjN6SIGlGswza
MD5:	9FA3FC24186D912B0694A572847D6D74
SHA1:	93184E00CBDDACAB7F2AD78447D0EAC1B764114D
SHA-256:	91508AB353B90B30FF2551020E9755D7AB0E860308F16C2F6417DFB2E9A75014
SHA-512:	95AD31C9082F57EA57F5B4C605331FCAD62735A1862AFB01EF8A67FEA4E450154C1AE0C411CF3AC5B9CD35741F8100409CC1910F69C1B2D807D252389812F594
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....P..........." .........................................................0.......`....`A........................................p................ ...................!..............p............................................................................rdata..P...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.6806369134652055
Encrypted:	false
SSDEEP:	192:qyMv0WthWPWf9BvVVWQ4mWIv/r+YVqnajKsSF:qyMv0WthWCNBfVlGsSF
MD5:	C9CBAD5632D4D42A1BC25CCFA8833601
SHA1:	09F37353A89F1BFE49F7508559DA2922B8EFEB05
SHA-256:	F3A7A9C98EBE915B1B57C16E27FFFD4DDF31A82F0F21C06FE292878E48F5883E
SHA-512:	2412E0AFFDC6DB069DE7BD9666B7BAA1CD76AA8D976C9649A4C2F1FFCE27F8269C9B02DA5FD486EC86B54231B1A5EBF6A1C72790815B7C253FEE1F211086892F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....E.=.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..,...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13776
Entropy (8bit):	6.573983778839785
Encrypted:	false
SSDEEP:	384:miwidv3V0dfpkXc0vVauzIWthWLN3fVlGsStY:nHdv3VqpkXc0vVaKbiYlY
MD5:	4CCDE2D1681217E282996E27F3D9ED2E
SHA1:	8EDA134B0294ED35E4BBAC4911DA620301A3F34D
SHA-256:	D6708D1254ED88A948871771D6D1296945E1AA3AEB7E33E16CC378F396C61045
SHA-512:	93FE6AE9A947AC88CC5ED78996E555700340E110D12B2651F11956DB7CEE66322C269717D31FCCB31744F4C572A455B156B368F08B70EDA9EFFEC6DE01DBAB23
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....k,..........." .........................................................0......3.....`A........................................p...X............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.7137872023984055
Encrypted:	false
SSDEEP:	192:TtZ3KjWthWzWf9BvVVWQ4mWXU0P+CjAWqnajKsN2v:TtZ3KjWthWeNwP+CcWlGsNa
MD5:	E86CFC5E1147C25972A5EEFED7BE989F
SHA1:	0075091C0B1F2809393C5B8B5921586BDD389B29
SHA-256:	72C639D1AFDA32A65143BCBE016FE5D8B46D17924F5F5190EB04EFE954C1199A
SHA-512:	EA58A8D5AA587B7F5BDE74B4D394921902412617100ED161A7E0BEF6B3C91C5DAE657065EA7805A152DD76992997017E070F5415EF120812B0D61A401AA8C110
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...jN/..........." .........................................................0............`A........................................p...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12768
Entropy (8bit):	6.614330511483598
Encrypted:	false
SSDEEP:	192:vgdKIMFYJWthW2Wf9BvVVWQ4SW2zZ7uUgxfzfqnaj0OGWh:0hJWthW7NBzIrloYh
MD5:	206ADCB409A1C9A026F7AFDFC2933202
SHA1:	BB67E1232A536A4D1AE63370BD1A9B5431335E77
SHA-256:	76D8E4ED946DEEFEEFA0D0012C276F0B61F3D1C84AF00533F4931546CBB2F99E
SHA-512:	727AA0C4CD1A0B7E2AFFDCED5DA3A0E898E9BAE3C731FF804406AD13864CEE2B27E5BAAC653BAB9A0D2D961489915D4FCAD18557D4383ECB0A066902276955A7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....~y..........." .........................................................0............`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.704366348384627
Encrypted:	false
SSDEEP:	192:Ha2WthWKOWf9BvVVWQ4mWNOrVT/gqnajKsrCkb:Ha2WthWKTNz1IlGsrCo
MD5:	91A2AE3C4EB79CF748E15A58108409AD
SHA1:	D402B9DF99723EA26A141BFC640D78EAF0B0111B
SHA-256:	B0EDA99EABD32FEFECC478FD9FE7439A3F646A864FDAB4EC3C1F18574B5F8B34
SHA-512:	8527AF610C1E2101B6F336A142B1A85AC9C19BB3AF4AD4A245CFB6FD602DC185DA0F7803358067099475102F3A8F10A834DC75B56D3E6DED2ED833C00AD217ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....%j.........." .........................................................0......\|B....`A........................................p...P............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.623077637622405
Encrypted:	false
SSDEEP:	192:jWthWYWf9BvVVWQ4mWd8l1P+CjAWqnajKsNeCw:jWthW9NnP+CcWlGsNex
MD5:	1E4C4C8E643DE249401E954488744997
SHA1:	DB1C4C0FC907100F204B21474E8CD2DB0135BC61
SHA-256:	F28A8FE2CD7E8E00B6D2EC273C16DB6E6EEA9B6B16F7F69887154B6228AF981E
SHA-512:	EF8411FD321C0E363C2E5742312CC566E616D4B0A65EFF4FB6F1B22FDBEA3410E1D75B99E889939FF70AD4629C84CEDC88F6794896428C5F0355143443FDC3A3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....R..........." .........................................................0............`A........................................p...<............ ...................!..............p............................................................................rdata..p...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.643812426159955
Encrypted:	false
SSDEEP:	192:fSWthWvWf9BvVVWQ4mWFl5P+CjAWqnajKsNifl:aWthWiN+5P+CcWlGsNiN
MD5:	FA770BCD70208A479BDE8086D02C22DA
SHA1:	28EE5F3CE3732A55CA60AEE781212F117C6F3B26
SHA-256:	E677497C1BAEFFFB33A17D22A99B76B7FA7AE7A0C84E12FDA27D9BE5C3D104CF
SHA-512:	F8D81E350CEBDBA5AFB579A072BAD7986691E9F3D4C9FEBCA8756B807301782EE6EB5BA16B045CFA29B6E4F4696E0554C718D36D4E64431F46D1E4B1F42DC2B8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................" .........................................................0......l.....`A........................................P................ ...................!..............p............................................................................rdata..@...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15824
Entropy (8bit):	6.438848882089563
Encrypted:	false
SSDEEP:	192:yjQ/w8u4cyNWthWYWf9BvVVWQ4mWhu1BVT/gqnajKsrC74m:8yNWthW9Np1IlGsrCEm
MD5:	4EC4790281017E616AF632DA1DC624E1
SHA1:	342B15C5D3E34AB4AC0B9904B95D0D5B074447B7
SHA-256:	5CF5BBB861608131B5F560CBF34A3292C80886B7C75357ACC779E0BF98E16639
SHA-512:	80C4E20D37EFF29C7577B2D0ED67539A9C2C228EDB48AB05D72648A6ED38F5FF537715C130342BEB0E3EF16EB11179B9B484303354A026BDA3A86D5414D24E69
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....P............" .........................................................@............`A........................................P................0...................!..............p............................................................................rdata..>...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.6061629057490245
Encrypted:	false
SSDEEP:	192:vWOPWthWAWf9BvVVWQ4mWWbgftmP+CjAWqnajKsNURPblh:BWthWFN+f8P+CcWlGsNURzv
MD5:	7A859E91FDCF78A584AC93AA85371BC9
SHA1:	1FA9D9CAD7CC26808E697373C1F5F32AAF59D6B7
SHA-256:	B7EE468F5B6C650DADA7DB3AD9E115A0E97135B3DF095C3220DFD22BA277B607
SHA-512:	A368F21ECA765AFCA86E03D59CF953500770F4A5BFF8B86B2AC53F1B5174C627E061CE9A1F781DC56506774E0D0B09725E9698D4DC2D3A59E93DA7EF3D900887
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...t............." .........................................................0......H.....`A........................................P..."............ ...................!..............p............................................................................rdata..r...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13776
Entropy (8bit):	6.65347762698107
Encrypted:	false
SSDEEP:	192:WxSnWlC0i5ClWthWTWf9BvVVWQ4mW+hkKVT/gqnajKsrCw/:WxSnWm5ClWthW+NkK1IlGsrCY
MD5:	972544ADE7E32BFDEB28B39BC734CDEE
SHA1:	87816F4AFABBDEC0EC2CFEB417748398505C5AA9
SHA-256:	7102F8D9D0F3F689129D7FE071B234077FBA4DD3687071D1E2AEAA137B123F86
SHA-512:	5E1131B405E0C7A255B1C51073AFF99E2D5C0D28FD3E55CABC04D463758A575A954008EA1BA5B4E2B345B49AF448B93AD21DFC4A01573B3CB6E7256D9ECCEEF1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...1............" .........................................................0......':....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.58394079658593
Encrypted:	false
SSDEEP:	192:YFY17aFBRQWthWIWf9BvVVWQ4mWHhOP+CjAWqnajKsNngJ:YQtWthWNNdP+CcWlGsNI
MD5:	8906279245F7385B189A6B0B67DF2D7C
SHA1:	FCF03D9043A2DAAFE8E28DEE0B130513677227E4
SHA-256:	F5183B8D7462C01031992267FE85680AB9C5B279BEDC0B25AB219F7C2184766F
SHA-512:	67CAC89AE58CC715976107F3BDF279B1E78945AFD07E6F657E076D78E92EE1A98E3E7B8FEAE295AF5CE35E00C804F3F53A890895BADB1EED32377D85C21672B9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0.......l....`A........................................P................ ...................!..............p............................................................................rdata..f...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.696904963591775
Encrypted:	false
SSDEEP:	192:m8qWthWLWf9BvVVWQ4WWLXlyBZr+YVqnajKsS1:mlWthWWN0uZfVlGsS1
MD5:	DD8176E132EEDEA3322443046AC35CA2
SHA1:	D13587C7CC52B2C6FBCAA548C8ED2C771A260769
SHA-256:	2EB96422375F1A7B687115B132A4005D2E7D3D5DC091FB0EB22A6471E712848E
SHA-512:	77CB8C44C8CC8DD29997FBA4424407579AC91176482DB3CF7BC37E1F9F6AA4C4F5BA14862D2F3A9C05D1FDD7CA5A043B5F566BD0E9A9E1ED837DA9C11803B253
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...r..[.........." .........................................................0.......P....`A........................................P...e............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	6.216554714002396
Encrypted:	false
SSDEEP:	384:rQM4Oe59Ckb1hgmLRWthW0N0JBJ1IlGsrC5W:sMq59Bb1jYNABHJc
MD5:	A6A3D6D11D623E16866F38185853FACD
SHA1:	FBEADD1E9016908ECCE5753DE1D435D6FCF3D0B5
SHA-256:	A768339F0B03674735404248A039EC8591FCBA6FF61A3C6812414537BADD23B0
SHA-512:	ABBF32CEB35E5EC6C1562F9F3B2652B96B7DBD97BFC08D918F987C0EC0503E8390DD697476B2A2389F0172CD8CF16029FD2EC5F32A9BA3688BF2EBEEFB081B2C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........,...............................................P............`A........................................P....%...........@...............0...!..............p............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.604643094751227
Encrypted:	false
SSDEEP:	192:uFdyqjd7NWthWxWf9BvVVWQ4mW+JZD7DiqnajKswzR1:YQsWthWkNfZGlGswzR1
MD5:	074B81A625FB68159431BB556D28FAB5
SHA1:	20F8EAD66D548CFA861BC366BB1250CED165BE24
SHA-256:	3AF38920E767BD9EBC08F88EAF2D08C748A267C7EC60EAB41C49B3F282A4CF65
SHA-512:	36388C3EFFA0D94CF626DECAA1DA427801CC5607A2106ABDADF92252C6F6FD2CE5BF0802F5D0A4245A1FFDB4481464C99D60510CF95E83EBAF17BD3D6ACBC3DC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....u..........." .........................................................0............`A........................................P...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16336
Entropy (8bit):	6.449023660091811
Encrypted:	false
SSDEEP:	192:eUW9MPrpJhhf4AN5/KihWthWBWf9BvVVWQ4mWRXwsD7DiqnajKswzK:eUZr7HWthWUNkGlGswzK
MD5:	F1A23C251FCBB7041496352EC9BCFFBE
SHA1:	BE4A00642EC82465BC7B3D0CC07D4E8DF72094E8
SHA-256:	D899C2F061952B3B97AB9CDBCA2450290B0F005909DDD243ED0F4C511D32C198
SHA-512:	31F8C5CD3B6E153073E2E2EDF0CA8072D0F787784F1611A57219349C1D57D6798A3ADBD6942B0F16CEF781634DD8691A5EC0B506DF21B24CB70AEE5523A03FD9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....h.y.........." .........................................................@............`A........................................P...4............0...................!..............p............................................................................rdata..............................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17872
Entropy (8bit):	6.3934828478655685
Encrypted:	false
SSDEEP:	192:hA2uWYFxEpahDWthWDWf9BvVVWQ4mWR3ir+YVqnajKsSO:hIFVhDWthWONlfVlGsSO
MD5:	55B2EB7F17F82B2096E94BCA9D2DB901
SHA1:	44D85F1B1134EE7A609165E9C142188C0F0B17E0
SHA-256:	F9D3F380023A4C45E74170FE69B32BCA506EE1E1FBE670D965D5B50C616DA0CB
SHA-512:	0CF0770F5965A83F546253DECFA967D8F85C340B5F6EA220D3CAA14245F3CDB37C53BF8D3DA6C35297B22A3FA88E7621202634F6B3649D7D9C166A221D3456A5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d......w.........." ......... ...............................................@......>>....`A........................................P...a............0...............$...!..............p............................................................................rdata..............................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18384
Entropy (8bit):	6.279474608881223
Encrypted:	false
SSDEEP:	384:jvEvevdv8vPozmVx0C5yguNvZ5VQgx3SbwA7yMVIkFGlPWthWXNjqujGlGswz7:2ozmT5yguNvZ5VQgx3SbwA71IkFFaJft
MD5:	9B79965F06FD756A5EFDE11E8D373108
SHA1:	3B9DE8BF6B912F19F7742AD34A875CBE2B5FFA50
SHA-256:	1A916C0DB285DEB02C0B9DF4D08DAD5EA95700A6A812EA067BD637A91101A9F6
SHA-512:	7D4155C00D65C3554E90575178A80D20DC7C80D543C4B5C4C3F508F0811482515638FE513E291B82F958B4D7A63C9876BE4E368557B07FF062961197ED4286FB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...$............" ........."...............................................@............`A........................................P................0...............&...!..............p............................................................................rdata../...........................@..@.rsrc........0......."..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14288
Entropy (8bit):	6.547753630184197
Encrypted:	false
SSDEEP:	192:ENDCWthWHWf9BvVVWQ4mWG5xqcVT/gqnajKsrC/V:TWthW6N/xqc1IlGsrC/V
MD5:	1D48A3189A55B632798F0E859628B0FB
SHA1:	61569A8E4F37ADC353986D83EFC90DC043CDC673
SHA-256:	B56BC94E8539603DD2F0FEA2F25EFD17966315067442507DB4BFFAFCBC2955B0
SHA-512:	47F329102B703BFBB1EBAEB5203D1C8404A0C912019193C93D150A95BB0C5BA8DC101AC56D3283285F9F91239FC64A66A5357AFE428A919B0BE7194BADA1F64F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...E............" .........................................................0......f.....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.686357863452704
Encrypted:	false
SSDEEP:	192:ZjfHQdufWthWCWf9BvVVWQ4mWMlUteSP+CjAWqnajKsN0c:ZfZWthW/Nd4P+CcWlGsN0c
MD5:	DBC27D384679916BA76316FB5E972EA6
SHA1:	FB9F021F2220C852F6FF4EA94E8577368F0616A4
SHA-256:	DD14133ADF5C534539298422F6C4B52739F80ACA8C5A85CA8C966DEA9964CEB1
SHA-512:	CC0D8C56749CCB9D007B6D3F5C4A8F1D4E368BB81446EBCD7CC7B40399BBD56D0ACABA588CA172ECB7472A8CBDDBD4C366FFA38094A832F6D7E343B813BA565E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....@n#.........." .........................................................0............`A........................................P...^............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\base_library.zip

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1332005
Entropy (8bit):	5.586288557050693
Encrypted:	false
SSDEEP:	12288:uttcY+bStOmgRF1+fYNXPh26UZWAzCu7joqYnhjHgkVHdmmPnHz1d1YgCCaYcet:uttcY+UHCiCAd+cqHdmmPHzqEaYcet
MD5:	CCEE0EA5BA04AA4FCB1D5A19E976B54F
SHA1:	F7A31B2223F1579DA1418F8BFE679AD5CB8A58F5
SHA-256:	EEB7F0B3E56B03454868411D5F62F23C1832C27270CEE551B9CA7D9D10106B29
SHA-512:	4F29AC5DF211FEF941BD953C2D34CB0C769FB78475494746CB584790D9497C02BE35322B0C8F5C14FE88D4DD722733EDA12496DB7A1200224A014043F7D59166
Malicious:	false
Preview:	PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI63002\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5162776
Entropy (8bit):	5.958207976652471
Encrypted:	false
SSDEEP:	98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
MD5:	51E8A5281C2092E45D8C97FBDBF39560
SHA1:	C499C810ED83AAADCE3B267807E593EC6B121211
SHA-256:	2A234B5AA20C3FAECF725BBB54FB33F3D94543F78FA7045408E905593E49960A
SHA-512:	98B91719B0975CB38D3B3C7B6F820D184EF1B64D38AD8515BE0B8B07730E2272376B9E51631FE9EFD9B8A1709FEA214CF3F77B34EEB9FD282EB09E395120E7CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#..6..*......v.........................................O.......O...`.........................................0.G.0.....M.@....0N.\|.....K.\.....N../...@N.....PsC.8............................qC.@.............M..............................text...4.6.......6................. ..`.rdata..`.....6.......6.............@..@.data....n....J..<....J.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.... N.......M.............@..@.rsrc...\|....0N.......M.............@..@.reloc..k....@N.......M.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	790296
Entropy (8bit):	5.607732992846443
Encrypted:	false
SSDEEP:	6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
MD5:	BFC834BB2310DDF01BE9AD9CFF7C2A41
SHA1:	FB1D601B4FCB29FF1B13B0D2ED7119BD0472205C
SHA-256:	41AD1A04CA27A7959579E87FBBDA87C93099616A64A0E66260C983381C5570D1
SHA-512:	6AF473C7C0997F2847EBE7CEE8EF67CD682DEE41720D4F268964330B449BA71398FDA8954524F9A97CC4CDF9893B8BDC7A1CF40E9E45A73F4F35A37F31C6A9C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.6..........K........................................0.......w....`..........................................w...Q..............s.... ..pM......./......`... ...8...............................@............................................text....4.......6.................. ..`.rdata...y...P...z...:..............@..@.data....N.......H..................@....pdata..XV... ...X..................@..@.idata..bc.......d...T..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..?...........................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.905419806967227
Encrypted:	false
SSDEEP:	1536:BWseNxkc7Xva0Y420G1UD+dS4QBeLmRy:BWkcbi0Y42bUD+dS44eiRy
MD5:	3CBA71B6BC59C26518DC865241ADD80A
SHA1:	7E9C609790B1DE110328BBBCBB4CD09B7150E5BD
SHA-256:	E10B73D6E13A5AE2624630F3D8535C5091EF403DB6A00A2798F30874938EE996
SHA-512:	3EF7E20E382D51D93C707BE930E12781636433650D0A2C27E109EBEBEBA1F30EA3E7B09AF985F87F67F6B9D2AC6A7A717435F94B9D1585A9EB093A83771B43F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`T..$5..$5..$5..-M3..5..v@..&5..v@..(5..v@..,5..v@.. 5...k..&5..oM..55..$5...5...@..45...@..%5...@_.%5...@..%5..Rich$5..........................PE..d.....e.........." .........h..............................................@............`.........................................P...`.......@.... .......................0..(.......................................8............................................text............................... ..`.rdata..\|I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	199448
Entropy (8bit):	6.385306498353421
Encrypted:	false
SSDEEP:	3072:jJB/b2LOWs5LS04q1uqtF+ai7dYbmdRLjDxKyw6XUWdRBIpLhCujk:dB6yx5LT1gqtF+XGeL/xiBoR4g
MD5:	E2D1C738D6D24A6DD86247D105318576
SHA1:	384198F20724E4EDE9E7B68E2D50883C664EEE49
SHA-256:	CDC09FBAE2F103196215FACD50D108BE3EFF60C8EE5795DCC80BF57A0F120CDF
SHA-512:	3F9CB64B4456438DEA82A0638E977F233FAF0A08433F01CA87BA65C7E80B0680B0EC3009FA146F02AE1FDCC56271A66D99855D222E77B59A1713CAF952A807DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W,.6B..6B..6B..N..6B..IC..6B..IG..6B..IF..6B..IA..6B...C..6B..NC..6B..6C..6B...O..6B...B..6B......6B...@..6B.Rich.6B.........PE..d....Are.........." ...%............0................................................p....`......................................... ...P...p............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata..D.... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\python3.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68376
Entropy (8bit):	6.148687003588085
Encrypted:	false
SSDEEP:	768:/BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM8:pDmF61JFn+/OJBIpL0j7Sy5xH
MD5:	4038AF0427BCE296CA8F3E98591E0723
SHA1:	B2975225721959D87996454D049E6D878994CBF2
SHA-256:	A5BB3EB6FDFD23E0D8B2E4BCCD6016290C013389E06DAAE6CB83964FA69E2A4F
SHA-512:	DB762442C6355512625B36F112ECA6923875D10AAF6476D79DC6F6FFC9114E8C7757AC91DBCD1FB00014122BC7F656115160CF5D62FA7FA1BA70BC71346C1AD3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T...5e..5e..5e..m..5e..e..5e.....5e..g..5e.Rich.5e.........PE..d....Are.........." ...%..................................................................`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\python312.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7003928
Entropy (8bit):	5.780799677504345
Encrypted:	false
SSDEEP:	98304:2OUmnjqB6bHMYM3RNgqKutvDHDMiEtYkzuv:2OUmn+MnM3R+qYi3kzuv
MD5:	48EBFEFA21B480A9B0DBFC3364E1D066
SHA1:	B44A3A9B8C585B30897DDC2E4249DFCFD07B700A
SHA-256:	0CC4E557972488EB99EA4AEB3D29F3ADE974EF3BCD47C211911489A189A0B6F2
SHA-512:	4E6194F1C55B82EE41743B35D749F5D92A955B219DECACF9F1396D983E0F92AE02089C7F84A2B8296A3062AFA3F9C220DA9B7CD9ED01B3315EA4A953B4ECC6CE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............e..e..e.d..e....e.`..e.a..e.f..e....e..d..e..d...e.Bh.r.e.Be..e.B...e.Bg..e.Rich..e.................PE..d....Are.........." ...%..)..RB.....\|X........................................k.......k...`......................................... .O.d....[P......@j.......`..Y....j../...Pj.4Z...3.T.....................I.(.....3.@............0)..............................text...v.).......)................. ..`.rdata...P'..0)..R'...).............@..@.data....<....P......nP.............@....pdata...Y....`..Z...._.............@..@PyRuntim.....0c......Hb.............@....rsrc........@j......Ji.............@..@.reloc..4Z...Pj..\...Ti.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\select.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30488
Entropy (8bit):	6.584443317757654
Encrypted:	false
SSDEEP:	384:OyLTFInPLnIloHqP3DT90IBIpQG28HQIYiSy1pCQ5mrUAM+o/8E9VF0NyOYl:hinzfHqv1rBIpQG/5YiSyvkrUAMxkErl
MD5:	E1604AFE8244E1CE4C316C64EA3AA173
SHA1:	99704D2C0FA2687997381B65FF3B1B7194220A73
SHA-256:	74CCA85600E7C17EA6532B54842E26D3CAE9181287CDF5A4A3C50AF4DAB785E5
SHA-512:	7BF35B1A9DA9F1660F238C2959B3693B7D9D2DA40CF42C6F9EBA2164B73047340D0ADFF8995049A2FE14E149EBA05A5974EEE153BADD9E8450F961207F0B3D42
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..t.s.'.s.'.s.'..7'.s.'...&.s.'...&.s.'...&.s.'...&.s.'(.&.s.'.s.'Ps.'Y..&.s.'(.&.s.'(.&.s.'(.['.s.'(.&.s.'Rich.s.'........PE..d....Are.........." ...%.....2............................................................`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1035728
Entropy (8bit):	6.630126944065657
Encrypted:	false
SSDEEP:	24576:EsKxVJ/pRRK0Y/9fCrl4NbpjONcncXEomxvSZX0yp49C:lKxDPHQCrlQBXxw
MD5:	849959A003FA63C5A42AE87929FCD18B
SHA1:	D1B80B3265E31A2B5D8D7DA6183146BBD5FB791B
SHA-256:	6238CBFE9F57C142B75E153C399C478D492252FDA8CB40EE539C2DCB0F2EB232
SHA-512:	64958DABDB94D21B59254C2F074DB5D51E914DDBC8437452115DFF369B0C134E50462C3FDBBC14B6FA809A6EE19AB2FB83D654061601CC175CDDCB7D74778E09
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........of...5...5...5..5...5...5&..5...5...5...4...5...4...5...4...5...4...5...4..5...5...5...4...5Rich...5........PE..d.....$%.........." .....:..........0Z..............................................7^....`A................................................................. ...........!.............p........................... f..............................................text...09.......:.................. ..`.rdata..^....P.......>..............@..@.data....&..........................@....pdata....... ......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63002\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\3OQL58yflv.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1137944
Entropy (8bit):	5.4622357236004175
Encrypted:	false
SSDEEP:	12288:PrEHdcM6hb1CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciA0:PrEXQCjfk7bPNfv42BN6yzUiA0
MD5:	FC47B9E23DDF2C128E3569A622868DBE
SHA1:	2814643B70847B496CBDA990F6442D8FF4F0CB09
SHA-256:	2A50D629895A05B10A262ACF333E7A4A31DB5CB035B70D14D1A4BE1C3E27D309
SHA-512:	7C08683820498FDFF5F1703DB4AD94AD15F2AA877D044EDDC4B54D90E7DC162F48B22828CD577C9BB1B56F7C11F777F9785A9DA1867BF8C0F2B6E75DC57C3F53
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K..K..K..B.q.M..^..I..^..F..^..C..^..H..qE.H.....I..K.....qE.J..qE.J..qE..J..qE..J..RichK..........................PE..d....Are.........." ...%.>..........`*.......................................p...... A....`.........................................p...X............P.......@.........../...`......P^..T............................]..@............P..p............................text....=.......>.................. ..`.rdata..\....P.......B..............@..@.data...X.... ......................@....pdata.......@......................@..@.rsrc........P......."..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.993999124424823
TrID:	Win64 Executable GUI (202006/5) 77.37% InstallShield setup (43055/19) 16.49% Win64 Executable (generic) (12005/4) 4.60% Generic Win/DOS Executable (2004/3) 0.77% DOS Executable Generic (2002/1) 0.77%
File name:	3OQL58yflv.exe
File size:	10'580'892 bytes
MD5:	6cb409f46ff2c5fff4dccec2daa01c68
SHA1:	da84249c2f7ec40d36c2cd0771d6587471ef6c8a
SHA256:	230f90bb0e0b11907854e59e63a040b0524fe3e3d6790d290d6fca8d2e0a73f0
SHA512:	4aefb8687bface87bfca61da7a150f4e2d876f378365f9f1f36d3ff0ef36b3d8286b0e9beecde946c8cfddaffc32c623e18ef651bb3c0f921a17309393cf9196
SSDEEP:	196608:VyI9Yi07+K1W903eV4QRZMToEuGxgh858F0ibfUpWYgABAbk9yt8Rpr:z9Yiu+AW+eGQRZMTozGxu8C0ibfcWr+/
TLSH:	9FB63340F3540DF5EBB6C53B8656851AE332B9222364CAAB2374E2571FAB2425F3DF14
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Q...?...?...?.Z.<...?.Z.:...?.Z.;...?.......?...:.9.?...;...?...<...?.Z.>...?...>...?.+.;...?.+.=...?.Rich..?................

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x14000c1f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x676FC5D5 [Sat Dec 28 09:33:09 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	1af6c885af093afc55142c2f1761dbe8

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FAAECE9D9ECh
dec eax
add esp, 28h
jmp 00007FAAECE9D5FFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FAAECE9DF64h
test eax, eax
je 00007FAAECE9D7A3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FAAECE9D787h
dec eax
cmp ecx, eax
je 00007FAAECE9D796h
xor eax, eax
dec eax
cmpxchg dword ptr [0003427Ch], ecx
jne 00007FAAECE9D770h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FAAECE9D779h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [00034267h]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [00034257h], al
call 00007FAAECE9DD63h
call 00007FAAECE9EE82h
test al, al
jne 00007FAAECE9D786h
xor al, al
jmp 00007FAAECE9D796h
call 00007FAAECEABE21h
test al, al
jne 00007FAAECE9D78Bh
xor ecx, ecx
call 00007FAAECE9EE92h
jmp 00007FAAECE9D76Ch
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003421Ch], 00000000h
mov ebx, ecx
jne 00007FAAECE9D7E9h
cmp ecx, 01h
jnbe 00007FAAECE9D7ECh
call 00007FAAECE9DECAh
test eax, eax
je 00007FAAECE9D7AAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3cdcc	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x46000	0xf41c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x42000	0x22a4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x56000	0x75c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a330	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3a1f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x420	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29c90	0x29e00	62616acf257019688180f494b4eb78d4	False	0.5523087686567164	data	6.4831047330596565	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12bf4	0x12c00	830b1ac154e0c972c68f932b0f88cf15	False	0.5184375	data	5.835020431476157	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x3338	0xe00	99d84572872f2ce8d9bdbc2521e1966e	False	0.1328125	Matlab v4 mat-file (little endian) f\324\377\3772\242\337-\231+, text, rows 4294967295, columns 0	1.8271683819747706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x42000	0x22a4	0x2400	39f0a7d8241a665fc55289b5f9977819	False	0.4720052083333333	data	5.316391891279308	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x45000	0x15c	0x200	624222957a635749731104f8cdf6f9b7	False	0.38671875	data	2.83326547900447	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x46000	0xf41c	0xf600	c654ab5a3bc06ebf8c554f36c31153c0	False	0.8030837144308943	data	7.554967714213712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x56000	0x75c	0x800	4138d4447f190c2657ec208ef31be551	False	0.5458984375	data	5.240127521097618	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x46208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x470b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x47958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x47ec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x513ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x53994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x54a3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x54ea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x54f0c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	IsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetCPInfo, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 12:08:03.301189899 CET	49730	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:03.420892000 CET	20529	49730	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:03.421021938 CET	49730	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:05.903749943 CET	20529	49730	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:05.903825998 CET	49730	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:05.904830933 CET	49730	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:05.906913042 CET	49731	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:06.024485111 CET	20529	49730	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:06.026473999 CET	20529	49731	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:06.026555061 CET	49731	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:08.497160912 CET	20529	49731	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:08.497325897 CET	49731	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:08.498210907 CET	49731	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:08.499943018 CET	49732	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:08.617697001 CET	20529	49731	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:08.619461060 CET	20529	49732	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:08.619574070 CET	49732	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:11.065942049 CET	20529	49732	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:11.066044092 CET	49732	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:11.067049980 CET	49732	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:11.069082975 CET	49733	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:11.186644077 CET	20529	49732	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:11.188659906 CET	20529	49733	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:11.188741922 CET	49733	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:13.629333973 CET	20529	49733	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:13.629519939 CET	49733	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:13.630325079 CET	49733	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:13.632009029 CET	49734	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:13.750722885 CET	20529	49733	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:13.751689911 CET	20529	49734	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:13.751765013 CET	49734	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:16.198029995 CET	20529	49734	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:16.198105097 CET	49734	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:16.198923111 CET	49734	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:16.200551987 CET	49736	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:16.318499088 CET	20529	49734	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:16.320106983 CET	20529	49736	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:16.320610046 CET	49736	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:18.769882917 CET	20529	49736	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:18.770003080 CET	49736	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:18.770966053 CET	49736	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:18.772752047 CET	49738	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:18.890680075 CET	20529	49736	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:18.892400980 CET	20529	49738	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:18.892509937 CET	49738	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:21.363681078 CET	20529	49738	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:21.363754988 CET	49738	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:21.364624977 CET	49738	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:21.366239071 CET	49741	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:21.484666109 CET	20529	49738	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:21.486628056 CET	20529	49741	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:21.486705065 CET	49741	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:23.957808971 CET	20529	49741	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:23.959840059 CET	49741	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:23.960714102 CET	49741	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:23.962385893 CET	49743	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:24.080482960 CET	20529	49741	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:24.081907988 CET	20529	49743	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:24.082320929 CET	49743	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:26.616786003 CET	20529	49743	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:26.616949081 CET	49743	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:26.618149042 CET	49743	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:26.619868040 CET	49745	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:26.737718105 CET	20529	49743	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:26.739738941 CET	20529	49745	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:26.741894960 CET	49745	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:29.176682949 CET	20529	49745	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:29.176760912 CET	49745	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:29.177525043 CET	49745	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:29.179003954 CET	49746	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:29.297059059 CET	20529	49745	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:29.298765898 CET	20529	49746	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:29.298873901 CET	49746	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:31.769948006 CET	20529	49746	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:31.770072937 CET	49746	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:31.770970106 CET	49746	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:31.772710085 CET	49747	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:31.890425920 CET	20529	49746	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:31.892294884 CET	20529	49747	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:31.892374039 CET	49747	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:34.364006042 CET	20529	49747	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:34.364129066 CET	49747	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:34.378473043 CET	49747	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:34.393793106 CET	49748	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:34.498018980 CET	20529	49747	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:34.513302088 CET	20529	49748	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:34.513442993 CET	49748	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:36.948703051 CET	20529	49748	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:36.948805094 CET	49748	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:36.949640989 CET	49748	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:36.951298952 CET	49749	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:37.069207907 CET	20529	49748	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:37.071017027 CET	20529	49749	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:37.071114063 CET	49749	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:39.511152983 CET	20529	49749	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:39.511248112 CET	49749	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:39.512140036 CET	49749	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:39.513909101 CET	49750	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:39.631638050 CET	20529	49749	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:39.633495092 CET	20529	49750	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:39.633610964 CET	49750	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:42.057794094 CET	20529	49750	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:42.057923079 CET	49750	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:42.058798075 CET	49750	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:42.060506105 CET	49751	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:42.178364992 CET	20529	49750	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:42.180169106 CET	20529	49751	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:42.180246115 CET	49751	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:44.664808989 CET	20529	49751	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:44.664937973 CET	49751	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:44.665887117 CET	49751	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:44.667783022 CET	49752	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:44.785361052 CET	20529	49751	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:44.787229061 CET	20529	49752	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:44.787326097 CET	49752	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:47.183032990 CET	20529	49752	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:47.183144093 CET	49752	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:47.184964895 CET	49752	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:47.186839104 CET	49753	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:47.304404974 CET	20529	49752	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:47.306345940 CET	20529	49753	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:47.306449890 CET	49753	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:49.739099026 CET	20529	49753	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:49.739495039 CET	49753	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:49.740389109 CET	49753	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:49.742086887 CET	49754	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:49.859790087 CET	20529	49753	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:49.862385035 CET	20529	49754	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:49.862492085 CET	49754	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:52.332731009 CET	20529	49754	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:52.332809925 CET	49754	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:52.333725929 CET	49754	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:52.335659981 CET	49755	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:52.453937054 CET	20529	49754	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:52.455900908 CET	20529	49755	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:52.455976963 CET	49755	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:54.942579985 CET	20529	49755	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:54.942672014 CET	49755	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:54.943610907 CET	49755	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:54.945455074 CET	49756	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:55.063033104 CET	20529	49755	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:55.064944029 CET	20529	49756	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:55.065072060 CET	49756	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:57.638710022 CET	20529	49756	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:57.638904095 CET	49756	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:57.639779091 CET	49756	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:57.641475916 CET	49758	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:08:57.759186029 CET	20529	49756	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:57.760940075 CET	20529	49758	202.182.125.24	192.168.2.4
Dec 28, 2024 12:08:57.761087894 CET	49758	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:00.208134890 CET	20529	49758	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:00.208200932 CET	49758	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:00.209141016 CET	49758	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:00.210947037 CET	49760	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:00.328516006 CET	20529	49758	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:00.330476999 CET	20529	49760	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:00.330565929 CET	49760	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:02.730133057 CET	20529	49760	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:02.730227947 CET	49760	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:02.731143951 CET	49760	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:02.732928991 CET	49766	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:02.850754023 CET	20529	49760	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:02.852427006 CET	20529	49766	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:02.852508068 CET	49766	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:05.336941957 CET	20529	49766	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:05.337002993 CET	49766	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:05.337860107 CET	49766	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:05.339562893 CET	49772	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:05.457539082 CET	20529	49766	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:05.459059000 CET	20529	49772	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:05.459137917 CET	49772	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:07.943238020 CET	20529	49772	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:07.943327904 CET	49772	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:07.944178104 CET	49772	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:07.945821047 CET	49783	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:08.063649893 CET	20529	49772	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:08.065243959 CET	20529	49783	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:08.065325022 CET	49783	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:10.505322933 CET	20529	49783	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:10.505445004 CET	49783	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:10.506289959 CET	49783	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:10.507930994 CET	49789	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:10.625809908 CET	20529	49783	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:10.627438068 CET	20529	49789	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:10.627533913 CET	49789	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:13.118446112 CET	20529	49789	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:13.118586063 CET	49789	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:13.119551897 CET	49789	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:13.121395111 CET	49795	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:13.239263058 CET	20529	49789	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:13.240998030 CET	20529	49795	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:13.241111040 CET	49795	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:15.686686993 CET	20529	49795	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:15.686811924 CET	49795	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:15.687736034 CET	49795	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:15.689459085 CET	49801	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:15.807254076 CET	20529	49795	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:15.809103966 CET	20529	49801	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:15.809210062 CET	49801	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:18.307899952 CET	20529	49801	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:18.308001995 CET	49801	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:18.308929920 CET	49801	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:18.310653925 CET	49807	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:18.428420067 CET	20529	49801	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:18.430222034 CET	20529	49807	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:18.430313110 CET	49807	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:20.868284941 CET	20529	49807	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:20.868355989 CET	49807	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:20.869225979 CET	49807	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:20.870978117 CET	49813	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:20.988816023 CET	20529	49807	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:20.990552902 CET	20529	49813	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:20.992012978 CET	49813	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:23.490194082 CET	20529	49813	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:23.490284920 CET	49813	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:23.491096973 CET	49813	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:23.492727041 CET	49821	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:23.610483885 CET	20529	49813	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:23.612277985 CET	20529	49821	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:23.612371922 CET	49821	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:26.083734989 CET	20529	49821	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:26.083822012 CET	49821	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:26.084667921 CET	49821	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:26.131993055 CET	49829	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:26.204109907 CET	20529	49821	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:26.251463890 CET	20529	49829	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:26.251554966 CET	49829	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:28.655797958 CET	20529	49829	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:28.655879021 CET	49829	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:28.656744003 CET	49829	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:28.658526897 CET	49836	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:28.776417017 CET	20529	49829	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:28.778347015 CET	20529	49836	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:28.778445005 CET	49836	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:31.184379101 CET	20529	49836	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:31.184458017 CET	49836	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:31.191024065 CET	49836	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:31.212539911 CET	49842	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:31.310497999 CET	20529	49836	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:31.332257032 CET	20529	49842	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:31.332344055 CET	49842	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:33.803750992 CET	20529	49842	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:33.806114912 CET	49842	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:33.812587023 CET	49842	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:33.829375029 CET	49848	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:33.932287931 CET	20529	49842	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:33.949652910 CET	20529	49848	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:33.949749947 CET	49848	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:36.407926083 CET	20529	49848	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:36.408025980 CET	49848	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:36.426296949 CET	49848	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:36.433029890 CET	49854	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:36.546021938 CET	20529	49848	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:36.552651882 CET	20529	49854	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:36.552752018 CET	49854	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:38.998090982 CET	20529	49854	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:38.998176098 CET	49854	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:38.999032974 CET	49854	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:39.000677109 CET	49861	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:39.118527889 CET	20529	49854	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:39.120402098 CET	20529	49861	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:39.120517969 CET	49861	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:41.529500008 CET	20529	49861	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:41.529558897 CET	49861	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:41.530404091 CET	49861	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:41.532056093 CET	49869	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:41.649849892 CET	20529	49861	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:41.651496887 CET	20529	49869	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:41.651583910 CET	49869	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:44.452687979 CET	20529	49869	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:44.452816010 CET	49869	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:44.453664064 CET	49869	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:44.455357075 CET	49875	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:44.573213100 CET	20529	49869	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:44.575253963 CET	20529	49875	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:44.578274012 CET	49875	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:47.014484882 CET	20529	49875	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:47.014727116 CET	49875	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:47.015609026 CET	49875	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:47.017343044 CET	49883	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:47.135163069 CET	20529	49875	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:47.137103081 CET	20529	49883	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:47.137192011 CET	49883	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:49.548423052 CET	20529	49883	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:49.548635960 CET	49883	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:49.567657948 CET	49883	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:49.573235035 CET	49889	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:49.687216997 CET	20529	49883	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:49.692801952 CET	20529	49889	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:49.692883015 CET	49889	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:52.139333010 CET	20529	49889	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:52.139458895 CET	49889	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:52.174348116 CET	49889	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:52.177552938 CET	49895	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:52.293857098 CET	20529	49889	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:52.297116041 CET	20529	49895	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:52.297209024 CET	49895	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:54.739146948 CET	20529	49895	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:54.739242077 CET	49895	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:54.740057945 CET	49895	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:54.741686106 CET	49903	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:54.859550953 CET	20529	49895	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:54.861211061 CET	20529	49903	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:54.861294031 CET	49903	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:57.339437962 CET	20529	49903	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:57.339509964 CET	49903	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:57.340380907 CET	49903	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:57.342083931 CET	49909	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:57.460465908 CET	20529	49903	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:57.462004900 CET	20529	49909	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:57.462079048 CET	49909	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:59.923979044 CET	20529	49909	202.182.125.24	192.168.2.4
Dec 28, 2024 12:09:59.924129963 CET	49909	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:59.925009012 CET	49909	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:09:59.926803112 CET	49916	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:10:00.044657946 CET	20529	49909	202.182.125.24	192.168.2.4
Dec 28, 2024 12:10:00.046308041 CET	20529	49916	202.182.125.24	192.168.2.4
Dec 28, 2024 12:10:00.046422005 CET	49916	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:10:02.495316982 CET	20529	49916	202.182.125.24	192.168.2.4
Dec 28, 2024 12:10:02.498321056 CET	49916	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:10:02.499126911 CET	49916	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:10:02.500884056 CET	49923	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:10:02.618710995 CET	20529	49916	202.182.125.24	192.168.2.4
Dec 28, 2024 12:10:02.620493889 CET	20529	49923	202.182.125.24	192.168.2.4
Dec 28, 2024 12:10:02.620568991 CET	49923	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:10:05.061445951 CET	20529	49923	202.182.125.24	192.168.2.4
Dec 28, 2024 12:10:05.061505079 CET	49923	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:10:05.062323093 CET	49923	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:10:05.063999891 CET	49930	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:10:05.181859970 CET	20529	49923	202.182.125.24	192.168.2.4
Dec 28, 2024 12:10:05.183595896 CET	20529	49930	202.182.125.24	192.168.2.4
Dec 28, 2024 12:10:05.183790922 CET	49930	20529	192.168.2.4	202.182.125.24
Dec 28, 2024 12:10:07.667732954 CET	20529	49930	202.182.125.24	192.168.2.4
Dec 28, 2024 12:10:07.667844057 CET	49930	20529	192.168.2.4	202.182.125.24

Target ID:	0
Start time:	06:07:59
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\3OQL58yflv.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\3OQL58yflv.exe"
Imagebase:	0x7ff6e3770000
File size:	10'580'892 bytes
MD5 hash:	6CB409F46FF2C5FFF4DCCEC2DAA01C68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	06:08:01
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\3OQL58yflv.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\3OQL58yflv.exe"
Imagebase:	0x7ff6e3770000
File size:	10'580'892 bytes
MD5 hash:	6CB409F46FF2C5FFF4DCCEC2DAA01C68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000001.00000002.2934511808.00000225EDFB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000001.00000002.2934511808.00000225EDFB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_91bc5d7d, Description: unknown, Source: 00000001.00000002.2934511808.00000225EDFB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000001.00000002.2933864941.00000225ED810000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_91bc5d7d, Description: unknown, Source: 00000001.00000002.2933864941.00000225ED810000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_91bc5d7d, Description: unknown, Source: 00000001.00000002.2933458373.00000225ED568000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	23

Executed Functions

Function 00007FF6E3796370 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6E37963B5

Part of subcall function 00007FF6E3795D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3795D1C

Part of subcall function 00007FF6E378AF0C: RtlFreeHeap.NTDLL(?,?,?,00007FF6E3793392,?,?,?,00007FF6E37933CF,?,?,00000000,00007FF6E3793895,?,?,00000000,00007FF6E37937C7), ref: 00007FF6E378AF22
Part of subcall function 00007FF6E378AF0C: GetLastError.KERNEL32(?,?,?,00007FF6E3793392,?,?,?,00007FF6E37933CF,?,?,00000000,00007FF6E3793895,?,?,00000000,00007FF6E37937C7), ref: 00007FF6E378AF2C

Part of subcall function 00007FF6E378AEC4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6E378AEA3,?,?,?,?,?,00007FF6E37830CC), ref: 00007FF6E378AECD
Part of subcall function 00007FF6E378AEC4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6E378AEA3,?,?,?,?,?,00007FF6E37830CC), ref: 00007FF6E378AEF2

_get_daylight.LIBCMT ref: 00007FF6E37963A4

Part of subcall function 00007FF6E3795D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3795D7C

_get_daylight.LIBCMT ref: 00007FF6E379661A
_get_daylight.LIBCMT ref: 00007FF6E379662B
_get_daylight.LIBCMT ref: 00007FF6E379663C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6E379687C), ref: 00007FF6E3796663

Strings

Eastern Standard Time, xrefs: 00007FF6E3796709
Eastern Summer Time, xrefs: 00007FF6E3796721

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
Instruction ID: 304a298191ad95dd42bddcfa02a4206322e2fd0c276ea120bd14e867065dadea
Opcode Fuzzy Hash: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
Instruction Fuzzy Hash: ACD1E323A0821285EF20AF21D8523B93BA1EF447A4F424335DA4DE7695DF3EE461C34D

Function 00007FF6E37972BC Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E3796FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3797031
Part of subcall function 00007FF6E3796FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E37970AF
Part of subcall function 00007FF6E3796FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3797100

CreateFileW.KERNELBASE ref: 00007FF6E37973C2
CreateFileW.KERNEL32 ref: 00007FF6E3797412
GetLastError.KERNEL32 ref: 00007FF6E3797442
GetFileType.KERNELBASE ref: 00007FF6E3797457
GetLastError.KERNEL32 ref: 00007FF6E3797461
CloseHandle.KERNEL32 ref: 00007FF6E3797494
CloseHandle.KERNEL32 ref: 00007FF6E37975F7
CreateFileW.KERNEL32 ref: 00007FF6E379762C
GetLastError.KERNEL32 ref: 00007FF6E379763B

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
Instruction ID: 5152765be7caf816ededa414d1fe219e11f2d3929f9b5da4278bacb4b9dc725d
Opcode Fuzzy Hash: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
Instruction Fuzzy Hash: 98C1B537B24A8185EF10CF65C4826AC3B71F749BA8B424325DE1EAB395CF3AD465C349

Function 00007FF6E3777950 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF6E377154F), ref: 00007FF6E37779E7

Part of subcall function 00007FF6E3777B60: GetEnvironmentVariableW.KERNEL32(00007FF6E3773A1F), ref: 00007FF6E3777B9A
Part of subcall function 00007FF6E3777B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6E3777BB7

Part of subcall function 00007FF6E3787DEC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3787E05

SetEnvironmentVariableW.KERNEL32 ref: 00007FF6E3777AA1

Part of subcall function 00007FF6E3772B30: MessageBoxW.USER32 ref: 00007FF6E3772C05

Strings

TMP, xrefs: 00007FF6E37779B0
TMP, xrefs: 00007FF6E377798A, 00007FF6E3777A49, 00007FF6E3777AD7
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF6E37779CA
_MEI%d, xrefs: 00007FF6E37779F5

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: d0ee005bfdeb011a84540aff6346199bb1fc02b76f4ac94b865217064e0c6b04
Instruction ID: b01c6719c1c2131d24e9b49bdec20c1a7a5a8e80916b88bc96082e15c491d61c
Opcode Fuzzy Hash: d0ee005bfdeb011a84540aff6346199bb1fc02b76f4ac94b865217064e0c6b04
Instruction Fuzzy Hash: B351D513B0929341FD14A72698573BA7A91AF88BC1F054035EC0EE77D7EE2FE061860E

Function 00007FF6E37965EC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6E379661A

Part of subcall function 00007FF6E3795D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3795D7C

_get_daylight.LIBCMT ref: 00007FF6E379662B

Part of subcall function 00007FF6E3795D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3795D1C

_get_daylight.LIBCMT ref: 00007FF6E379663C

Part of subcall function 00007FF6E3795D38: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3795D4C

Part of subcall function 00007FF6E378AF0C: RtlFreeHeap.NTDLL(?,?,?,00007FF6E3793392,?,?,?,00007FF6E37933CF,?,?,00000000,00007FF6E3793895,?,?,00000000,00007FF6E37937C7), ref: 00007FF6E378AF22
Part of subcall function 00007FF6E378AF0C: GetLastError.KERNEL32(?,?,?,00007FF6E3793392,?,?,?,00007FF6E37933CF,?,?,00000000,00007FF6E3793895,?,?,00000000,00007FF6E37937C7), ref: 00007FF6E378AF2C

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6E379687C), ref: 00007FF6E3796663

Strings

Eastern Standard Time, xrefs: 00007FF6E3796709
Eastern Summer Time, xrefs: 00007FF6E3796721

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
Instruction ID: 028604030048ad4ce323c36ab0cd721cf8f6c5df329e9737812cdda9ace194a6
Opcode Fuzzy Hash: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
Instruction Fuzzy Hash: FD51C233A1864286EB10DF21E8827A97BA1FF48794F424235DA4DE7695DF3EE420874D

Function 00007FF6E3790F38 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 08e5aa8e339564cd7a7b65546afe2f45283a9087c0a557908bbbf8b75e3d7d61
Instruction ID: 95a171ac8b5b3643e67aee35d9792e7b40c271669a39747d3557d3f154eca282
Opcode Fuzzy Hash: 08e5aa8e339564cd7a7b65546afe2f45283a9087c0a557908bbbf8b75e3d7d61
Instruction Fuzzy Hash: 7C028D23A1965680FE65AF2194023793E91AF45BA0F064634DD6EEA7D1DE3EE431830E

Function 00007FF6E3771710 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fopen, xrefs: 00007FF6E3771797
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6E3771866
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6E3771806
fread, xrefs: 00007FF6E37718FC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6E37718F5
fwrite, xrefs: 00007FF6E37718EC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6E37717D9
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6E37718E5
fseek, xrefs: 00007FF6E377180D
malloc, xrefs: 00007FF6E377186D
Failed to create symbolic link %s!, xrefs: 00007FF6E3771753
pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF6E3771726
Failed to extract %s: failed to open target file!, xrefs: 00007FF6E3771790

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: e6c1ab7bb3c3a801f64289f44486b38c07945d09aa6b91d9999fd41f69d5c48e
Instruction ID: 9b4f8f95bcb068cd145d8a7036b01d2edf840e2ae3ad3df45ebdd3abd5a274dc
Opcode Fuzzy Hash: e6c1ab7bb3c3a801f64289f44486b38c07945d09aa6b91d9999fd41f69d5c48e
Instruction Fuzzy Hash: 1E51DD23B0868286EE109B11E8523B97B90FF44B95F440535DE0CA77D6EF3EE265970E

Function 00007FF6E3778950 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(0000000100000001,00007FF6E377414C,00007FF6E3777911,?,00007FF6E3777D26,?,00007FF6E3771785), ref: 00007FF6E3778990
OpenProcessToken.ADVAPI32(?,00007FF6E3777D26,?,00007FF6E3771785), ref: 00007FF6E37789A1
GetTokenInformation.KERNELBASE(?,00007FF6E3777D26,?,00007FF6E3771785), ref: 00007FF6E37789C3
GetLastError.KERNEL32(?,00007FF6E3777D26,?,00007FF6E3771785), ref: 00007FF6E37789CD
GetTokenInformation.KERNELBASE(?,00007FF6E3777D26,?,00007FF6E3771785), ref: 00007FF6E3778A0A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6E3778A1C
CloseHandle.KERNELBASE(?,00007FF6E3777D26,?,00007FF6E3771785), ref: 00007FF6E3778A34
LocalFree.KERNEL32(?,00007FF6E3777D26,?,00007FF6E3771785), ref: 00007FF6E3778A66
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF6E3778A8D
CreateDirectoryW.KERNELBASE(?,00007FF6E3777D26,?,00007FF6E3771785), ref: 00007FF6E3778A9E

Strings

D:(A;;FA;;;%s), xrefs: 00007FF6E3778A49
S-1-3-4, xrefs: 00007FF6E3778A3F

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 9d301874694f13eee612efc427f36135b77fc192910b60788b949b6aa4b4f411
Instruction ID: 34c19a3f7cdb602b2ad4454c7cf929690febd508c0cf0f44502403b9b6ac9811
Opcode Fuzzy Hash: 9d301874694f13eee612efc427f36135b77fc192910b60788b949b6aa4b4f411
Instruction Fuzzy Hash: 5B41BF3361C68682EE108F50E8867BA7B60FB84790F450231EA5E97AE4DF3DE414CB09

Function 00007FF6E3771AA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E37782B0: _fread_nolock.LIBCMT ref: 00007FF6E377835A

_fread_nolock.LIBCMT ref: 00007FF6E3771B54

Part of subcall function 00007FF6E3772890: MessageBoxW.USER32 ref: 00007FF6E377299B

Strings

malloc, xrefs: 00007FF6E3771BDD
fseek, xrefs: 00007FF6E3771B33
Failed to seek to cookie position!, xrefs: 00007FF6E3771B2C
Failed to read cookie!, xrefs: 00007FF6E3771B5F
Error on file., xrefs: 00007FF6E3771C36
Could not read full TOC!, xrefs: 00007FF6E3771C09
fread, xrefs: 00007FF6E3771B66, 00007FF6E3771C10
MEI, xrefs: 00007FF6E3771AE2
Could not allocate buffer for TOC!, xrefs: 00007FF6E3771BD6

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: dcf7c84ed462617b0e0dce36cb9749f58e0a0a21bbdd9ff1a57d48b7c6d024f3
Instruction ID: 791e7d83807920a04ce5e302bf8053aad29762a84f2bf5c856b15bcfb9301f1d
Opcode Fuzzy Hash: dcf7c84ed462617b0e0dce36cb9749f58e0a0a21bbdd9ff1a57d48b7c6d024f3
Instruction Fuzzy Hash: D7519E73A0860286EF14CF28D4862783FA0EF48B95B558135D90CD77A5DE7EE460CB4E

Function 00007FF6E3778080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E3778AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3772ABB), ref: 00007FF6E3778B1A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF6E3773D52), ref: 00007FF6E37780CF
GetStartupInfoW.KERNEL32 ref: 00007FF6E37780EE

Part of subcall function 00007FF6E378AA14: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E378AA28

Part of subcall function 00007FF6E3788630: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3788697

GetCommandLineW.KERNEL32 ref: 00007FF6E377818E
CreateProcessW.KERNELBASE ref: 00007FF6E37781D0
WaitForSingleObject.KERNEL32 ref: 00007FF6E37781E4
GetExitCodeProcess.KERNEL32 ref: 00007FF6E37781F4

Strings

Error creating child process!, xrefs: 00007FF6E3778200
CreateProcessW, xrefs: 00007FF6E3778207

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
Instruction ID: 8e654cadf018bca18b03f70b7f858e5e655a90bba62170b16c5d79ff64b23871
Opcode Fuzzy Hash: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
Instruction Fuzzy Hash: D3413333A0878582DE209B64E4563AABBA0FF94760F500335E6AD93BD5DF7DD054CB09

Function 00007FF6E3771000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E3773EC0: GetModuleFileNameW.KERNEL32(?,00007FF6E37739EA), ref: 00007FF6E3773EF1

SetDllDirectoryW.KERNEL32 ref: 00007FF6E3773BE9

Part of subcall function 00007FF6E3777B60: GetEnvironmentVariableW.KERNEL32(00007FF6E3773A1F), ref: 00007FF6E3777B9A
Part of subcall function 00007FF6E3777B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6E3777BB7

Strings

Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF6E3773AC6
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF6E3773B60
_PYI_ONEDIR_MODE, xrefs: 00007FF6E3773A34, 00007FF6E3773A5F
MEI, xrefs: 00007FF6E3773B1B
_MEIPASS2, xrefs: 00007FF6E3773A0B, 00007FF6E3773A74, 00007FF6E3773D22, 00007FF6E3773D2E
Failed to convert DLL search path!, xrefs: 00007FF6E3773BD1

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: bc804580661d330fd68571be0a8a6f4046a9eb4bd7f0ff81acb8572ffe878501
Instruction ID: 364cbc825e1017c3e3c677885c313eedeb411a04700303a1b0141e0990693db5
Opcode Fuzzy Hash: bc804580661d330fd68571be0a8a6f4046a9eb4bd7f0ff81acb8572ffe878501
Instruction Fuzzy Hash: 81B17023B1C68641FE24AB2194533B93A91EF44786F400131EE4DE76DAEE2EE535C74E

Function 00007FF6E3771050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF6E37710F8, 00007FF6E3771126
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6E3771249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6E37710B4
1.2.13, xrefs: 00007FF6E377107E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6E37710F1
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6E377111F

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: 20f07d5497f98b98d29e47cc3211355221ae8af9de98a618917402c82fb68268
Instruction ID: b7a1116510a9d6c02c1e204db3ec8ddb19b46cccbf94a1ae8649bc8ae9f8415b
Opcode Fuzzy Hash: 20f07d5497f98b98d29e47cc3211355221ae8af9de98a618917402c82fb68268
Instruction Fuzzy Hash: 3C51FE23B0868285EE209B11A8423BA7A90FF84795F444135EE4DE77D5EF3EE464C70E

Function 00007FF6E378C01C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E378C449

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be7416da91f84ed5bfdd546aa92e4ee07cb2f4e154380db95b5ab7bb0620c26f
Instruction ID: 10ca7829b305d2ca2af519f27d6d608747807532ace47762c0281e000b791913
Opcode Fuzzy Hash: be7416da91f84ed5bfdd546aa92e4ee07cb2f4e154380db95b5ab7bb0620c26f
Instruction Fuzzy Hash: 7CC1F0239086A781EF608B5594463BDBF60EB84B90F550131DA4EA77D1CF7EE865C30E

Function 00007FF6E378D520 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF6E378D50B), ref: 00007FF6E378D63C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF6E378D50B), ref: 00007FF6E378D6C7

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
Instruction ID: 796222564f7aa1c0bc839d92c1cb90a7a8b834df1b746face6dd42ccb20c93f5
Opcode Fuzzy Hash: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
Instruction Fuzzy Hash: 5491B123F0876685FB609F6594467BE3FE0AB44B98F144139DE0EB6694CF3AD461830E

Function 00007FF6E378FCEC Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6E378FDDC
_get_daylight.LIBCMT ref: 00007FF6E378FDED
_get_daylight.LIBCMT ref: 00007FF6E378FDFE
_isindst.LIBCMT ref: 00007FF6E378FEC9

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
Instruction ID: eaa7a319073d2c3dfff734a6518a23fd50ad8d9f093035877323d2da7b58bbed
Opcode Fuzzy Hash: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
Instruction Fuzzy Hash: 6651D373F0422286EF14DF28E95A7BC3BA1AF40368F140236DD1DA2AD5DF39A411C709

Function 00007FF6E3785854 Relevance: 6.1, APIs: 4, Instructions: 119
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 00007FF6E3785887
GetFileInformationByHandle.KERNELBASE ref: 00007FF6E37858E9
GetLastError.KERNEL32 ref: 00007FF6E378597A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,?,00007FF6E378578C), ref: 00007FF6E37859C6

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 76a0635d5597b22ce5d2941ff6046abd28e8f163941117926f9164ef5776c06c
Instruction ID: 0c814b0fe88b08cbe0e706163fd64680b505e415af7428c1bab6b66d7ff7aa79
Opcode Fuzzy Hash: 76a0635d5597b22ce5d2941ff6046abd28e8f163941117926f9164ef5776c06c
Instruction Fuzzy Hash: 00519023A186518AFF10CF71D4523BD3BB1AB48B78F108535DE4DAB689DF39D4A1870A

Function 00007FF6E377C07C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6E377C08B

Part of subcall function 00007FF6E377C24C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6E377C26E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6E377C0A0
__scrt_release_startup_lock.LIBCMT ref: 00007FF6E377C10E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6E377C161

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 416c85195b1c4a12d0bca0f9f3e62a22dfdeb9afd9333f8228f8268f9139cf84
Instruction ID: cb0f75f2a4be6125b263588a5e3be2bf54405f4875f4fc0ae8269ebdabab997d
Opcode Fuzzy Hash: 416c85195b1c4a12d0bca0f9f3e62a22dfdeb9afd9333f8228f8268f9139cf84
Instruction Fuzzy Hash: 2C315C53A0824781FE24AB6494533B93E91DF4978AF540035E90EFB2E7DE2FA424C21F

Function 00007FF6E3785700 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E378572D
CreateFileW.KERNELBASE ref: 00007FF6E378576C
CloseHandle.KERNEL32 ref: 00007FF6E37857A1

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
Instruction ID: b53f6c45e37e5fc2f7a6e875bb649ebbfca1bd19f8c6f9221afb9ef3e7695755
Opcode Fuzzy Hash: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
Instruction Fuzzy Hash: 0A41B123D2879283EB508B2195453A97B60FF947B4F108338EA9C93AD5DF7DA5B08709

Function 00007FF6E378027C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E37802C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E37803B7

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2f7bb398de8c4fd3266a2cb5114fed605c2779b223882c17691b198031e80610
Instruction ID: 4c97857e9e356f251c1930bbf585b9764023e0dd352098cb22ef5853afe0ed59
Opcode Fuzzy Hash: 2f7bb398de8c4fd3266a2cb5114fed605c2779b223882c17691b198031e80610
Instruction Fuzzy Hash: A251F623B0966196FF649E26940277A7A81BF44BB4F144634DD6CA77C5CE3EE420C60E

Function 00007FF6E378C6F4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF6E378C88D), ref: 00007FF6E378C740
GetLastError.KERNEL32(?,?,?,?,?,00007FF6E378C88D), ref: 00007FF6E378C74A

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
Instruction ID: ac845da7a08cd092bf2932d002218cb9dda0c18a48b933068437102499b00ad9
Opcode Fuzzy Hash: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
Instruction Fuzzy Hash: AA110163718B9281EE108B25A405269BB61EB44BF4F940335EEBD9B7D9CF3DD061870D

Function 00007FF6E37859FC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E3785911), ref: 00007FF6E3785A2F
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E3785911), ref: 00007FF6E3785A45

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
Instruction ID: fa9e5c4e3c60f33bd37be0826a0c19d6ab1136ed38d544f363078014bb48ca40
Opcode Fuzzy Hash: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
Instruction Fuzzy Hash: BF118F2361C65681EE548B10A48227EBFB0FB847B1F500235EA9DD59D8EF2ED064CB09

Function 00007FF6E378AF0C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF6E3793392,?,?,?,00007FF6E37933CF,?,?,00000000,00007FF6E3793895,?,?,00000000,00007FF6E37937C7), ref: 00007FF6E378AF22
GetLastError.KERNEL32(?,?,?,00007FF6E3793392,?,?,?,00007FF6E37933CF,?,?,00000000,00007FF6E3793895,?,?,00000000,00007FF6E37937C7), ref: 00007FF6E378AF2C

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
Instruction ID: 6e8c72957bb5d970519f8a13b0b3a577e7e16c38a5c44206b7dc703bd69eee25
Opcode Fuzzy Hash: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
Instruction Fuzzy Hash: D2E08C52F0920682FF48ABB258473393E619F8CB11F404434D80EE6292DE2EA8A5821E

Function 00007FF6E378B11C Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF6E378AF99,?,?,00000000,00007FF6E378B04E), ref: 00007FF6E378B18A
GetLastError.KERNEL32(?,?,?,00007FF6E378AF99,?,?,00000000,00007FF6E378B04E), ref: 00007FF6E378B194

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
Instruction ID: 6d5c571f16d1fede9786df0f9fab306720f5c07c32d2f2a9c2dcb1b98159f405
Opcode Fuzzy Hash: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
Instruction Fuzzy Hash: C321D723F1869241FE905B6494563793E929F447A0F444234DA1EDB3D6CF6DE465830F

Function 00007FF6E378C46C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E378C494

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6c27d5487ee8182774302d92aae2f9046d2b98e9277a8b83ca44002d61502fcf
Instruction ID: aaf1364c5623a0d1b95e30e1ddd40662bf27edb9ee02044fbf1e937dec0301a6
Opcode Fuzzy Hash: 6c27d5487ee8182774302d92aae2f9046d2b98e9277a8b83ca44002d61502fcf
Instruction Fuzzy Hash: F341D43390925287EE74CB29E542379BFA0EB55B51F100231D68EE3691CF2EE452C75E

Function 00007FF6E37782B0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6E377835A

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: a3484fdf5a082daa6d57b09c7b03b0fff055ecd784837a7b9601aa0a95c93dc9
Instruction ID: b029040ee443801a3f3a1ac8472bd4a41853e8a7d527ea6a9f97097dc5d913eb
Opcode Fuzzy Hash: a3484fdf5a082daa6d57b09c7b03b0fff055ecd784837a7b9601aa0a95c93dc9
Instruction Fuzzy Hash: A6219323B0826255FE509A16A4067BE7E51FF49BD5F885430EE0D977C6CE3EE051820E

Function 00007FF6E378BEFC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E378BF82

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf493e245973df117cfb9bdb4be30e1b7cc3e093745a0bb3aa436662ba277ffd
Instruction ID: e28a227b0b64fa3d3bdaab47104f04edc94bbe34a38831a883b1e4e200f6fb67
Opcode Fuzzy Hash: cf493e245973df117cfb9bdb4be30e1b7cc3e093745a0bb3aa436662ba277ffd
Instruction Fuzzy Hash: 22315E23A1866285FF519B56884237C3F60AF84BA5F410135EA1DA73D2CF7EE861871E

Function 00007FF6E37864A8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E378640D

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction ID: e9219d21f1f490c94479fc151a5bafb1decdad8fa457be5d0aeacf4e107d783c
Opcode Fuzzy Hash: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction Fuzzy Hash: BF118423E1C66181EE609F51A40337DBA64BF85B80F154431EB4DA7A86DF7ED560C70E

Function 00007FF6E3796CAC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3796CCF

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
Instruction ID: f2648370199b2597b44ef2d0be142ba50485e30359a61460e7c872cd81c465a4
Opcode Fuzzy Hash: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
Instruction Fuzzy Hash: 4921C533A1CA4186DF618F18E4423797BA0EB85B64F154334EA5D976D9DF3ED820CB09

Function 00007FF6E37804FC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3780550

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
Instruction ID: 5cfd3073c55faec2801a899fcc250f7b9628b1d40a24741c2b57f0ab3fd7572f
Opcode Fuzzy Hash: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
Instruction Fuzzy Hash: F601C863A0875540EE04DB565902669BEA1BF85FE0F084670EE5CA7BD6CE3DD421830D

Function 00007FF6E3787AB0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3787AEE

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: af50f55acc611b54009b4ea4d598cf3424078558251c62237d26469a9987366e
Instruction ID: 591bea232c2aacae17ac62210e291b18a299df819281e56475f6ab6a33f4e787
Opcode Fuzzy Hash: af50f55acc611b54009b4ea4d598cf3424078558251c62237d26469a9987366e
Instruction Fuzzy Hash: C701A112E1D2E340FEA06B6965833753D919F403A0F140534E92EE2AC6DF2FE471460F

Function 00007FF6E3787DEC Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3787E05

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f6d2080b1b78402d7abe66b145058d3ba054e314cadcac67310d584db64078aa
Instruction ID: f4a382506ad318b1a6744bdb8b8ec6b5afba1a12fcc5d17765fec960746ebb8e
Opcode Fuzzy Hash: f6d2080b1b78402d7abe66b145058d3ba054e314cadcac67310d584db64078aa
Instruction Fuzzy Hash: 5EE0E656E1836642FF5576A149C33B53A105F54352F044430D90EDA2D3DE1F6C75952F

Function 00007FF6E378F158 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF6E378B9A6,?,?,?,00007FF6E378AB67,?,?,00000000,00007FF6E378AE02), ref: 00007FF6E378F1AD

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
Instruction ID: 7a8bf0d7ef62aeed66c6f26c973f92609f2ffe960e6a09ab8ab2a59a3264bf6e
Opcode Fuzzy Hash: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
Instruction Fuzzy Hash: 7AF06207F0961681FE549A61E9133B53A915F49B50F4C4430CD0DE67C1DE5EE460C21E

Function 00007FF6E378DBBC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6E3780D24,?,?,?,00007FF6E3782236,?,?,?,?,?,00007FF6E3783829), ref: 00007FF6E378DBFA

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
Instruction ID: 65e48450fde47f943b9954656b02be7711dc7da31da6892ac61b140bd62a1a5f
Opcode Fuzzy Hash: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
Instruction Fuzzy Hash: 15F08203B0C3A745FE54576258033763ED09F48770F080730DD2EEA2C1DE6EA860851E

Non-executed Functions

Function 00007FF6E37751E0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF6E377346E), ref: 00007FF6E37751F0
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E377346E), ref: 00007FF6E377522A
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E377346E), ref: 00007FF6E377524F
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E377346E), ref: 00007FF6E3775274
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E377346E), ref: 00007FF6E377529C
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E377346E), ref: 00007FF6E37752C4
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E377346E), ref: 00007FF6E37752EC
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E377346E), ref: 00007FF6E3775314
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E377346E), ref: 00007FF6E377533C
GetProcAddress.KERNEL32(?,?,00000000,00007FF6E377346E), ref: 00007FF6E3775364

Strings

Failed to get address for PyConfig_SetString, xrefs: 00007FF6E37753C6
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF6E3775466
PyEval_EvalCode, xrefs: 00007FF6E37754EA
PyUnicode_Replace, xrefs: 00007FF6E37758AA
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF6E3775826
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF6E377584E
Failed to get address for PyConfig_Clear, xrefs: 00007FF6E3775326
PySys_SetObject, xrefs: 00007FF6E3775792
PyErr_Restore, xrefs: 00007FF6E37754C2
Failed to get address for PyUnicode_Join, xrefs: 00007FF6E377589E
PyUnicode_FromString, xrefs: 00007FF6E377585A
PyConfig_Clear, xrefs: 00007FF6E377530A
PyModule_GetDict, xrefs: 00007FF6E3775602
Failed to get address for PyObject_Str, xrefs: 00007FF6E37756E6
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6E377570E
PyConfig_SetBytesString, xrefs: 00007FF6E3775382
Py_ExitStatusException, xrefs: 00007FF6E3775245
PyUnicode_Decode, xrefs: 00007FF6E37757E2
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF6E3775696
PyConfig_SetWideStringList, xrefs: 00007FF6E37753D2
Failed to get address for PyEval_EvalCode, xrefs: 00007FF6E3775506
Failed to get address for PyErr_Fetch, xrefs: 00007FF6E377543E
PyRun_SimpleStringFlags, xrefs: 00007FF6E377571A
PyConfig_SetString, xrefs: 00007FF6E37753AA
PyErr_Fetch, xrefs: 00007FF6E3775422
Py_PreInitialize, xrefs: 00007FF6E37752E2
PyConfig_InitIsolatedConfig, xrefs: 00007FF6E3775332
Failed to get address for Py_ExitStatusException, xrefs: 00007FF6E3775261
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF6E377566E
PyList_Append, xrefs: 00007FF6E377558A
PyObject_Str, xrefs: 00007FF6E37756CA
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF6E37752AE
PyObject_CallFunctionObjArgs, xrefs: 00007FF6E3775652
Failed to get address for Py_PreInitialize, xrefs: 00007FF6E37752FE
Failed to get address for PyMem_RawFree, xrefs: 00007FF6E37755F6
GetProcAddress, xrefs: 00007FF6E3775209
Py_IsInitialized, xrefs: 00007FF6E37752BA
PyObject_GetAttrString, xrefs: 00007FF6E377567A
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF6E377534E
PyImport_ExecCodeModule, xrefs: 00007FF6E377553A
Failed to get address for PyConfig_Read, xrefs: 00007FF6E3775376
Failed to get address for PyUnicode_Decode, xrefs: 00007FF6E37757FE
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF6E37757D6
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF6E3775556
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF6E37755CE
Failed to get address for PyUnicode_FromString, xrefs: 00007FF6E3775876
PyStatus_Exception, xrefs: 00007FF6E3775742
Py_DecRef, xrefs: 00007FF6E37751E6
Py_DecodeLocale, xrefs: 00007FF6E3775220
Failed to get address for PyErr_Occurred, xrefs: 00007FF6E377548E
PyErr_Print, xrefs: 00007FF6E377549A
Failed to get address for Py_DecodeLocale, xrefs: 00007FF6E377523C
PyUnicode_FromFormat, xrefs: 00007FF6E3775832
Failed to get address for PyImport_ImportModule, xrefs: 00007FF6E377557E
Failed to get address for PyList_Append, xrefs: 00007FF6E37755A6
PyErr_Clear, xrefs: 00007FF6E37753FA
Failed to get address for Py_DecRef, xrefs: 00007FF6E3775202
Failed to get address for PySys_GetObject, xrefs: 00007FF6E3775786
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF6E37753EE
PyUnicode_AsUTF8, xrefs: 00007FF6E37757BA
PyConfig_Read, xrefs: 00007FF6E377535A
Failed to get address for Py_IsInitialized, xrefs: 00007FF6E37752D6
Failed to get address for PyObject_CallFunction, xrefs: 00007FF6E3775646
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF6E3775736
Failed to get address for PyModule_GetDict, xrefs: 00007FF6E377561E
PyErr_Occurred, xrefs: 00007FF6E3775472
Failed to get address for PyErr_Print, xrefs: 00007FF6E37754B6
PyUnicode_DecodeFSDefault, xrefs: 00007FF6E377580A
PyImport_ImportModule, xrefs: 00007FF6E3775562
Failed to get address for PyErr_Restore, xrefs: 00007FF6E37754DE
PySys_GetObject, xrefs: 00007FF6E377576A
PyObject_CallFunction, xrefs: 00007FF6E377562A
PyMem_RawFree, xrefs: 00007FF6E37755DA
Failed to get address for PySys_SetObject, xrefs: 00007FF6E37757AE
Failed to get address for PyImport_AddModule, xrefs: 00007FF6E377552E
PyMarshal_ReadObjectFromString, xrefs: 00007FF6E37755B2
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6E37756F2
Failed to get address for PyStatus_Exception, xrefs: 00007FF6E377575E
PyImport_AddModule, xrefs: 00007FF6E3775512
Failed to get address for PyUnicode_Replace, xrefs: 00007FF6E37758C6
Py_Finalize, xrefs: 00007FF6E377526A
Py_InitializeFromConfig, xrefs: 00007FF6E3775292
PyUnicode_Join, xrefs: 00007FF6E3775882
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF6E37756BE
PyObject_SetAttrString, xrefs: 00007FF6E37756A2
Failed to get address for Py_Finalize, xrefs: 00007FF6E3775286
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF6E377539E
Failed to get address for PyErr_Clear, xrefs: 00007FF6E3775416
PyErr_NormalizeException, xrefs: 00007FF6E377544A

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
Instruction ID: 1aad55f1c048a620a14ef1e02145586ef58c42be4906615a3f999a5da2f52b9e
Opcode Fuzzy Hash: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
Instruction Fuzzy Hash: 3D12DA66A1EB0391FE14CF08A8533703EB1AF44791B951535C81EF62A4EF7EA568C30E

Function 00007FF6E3771F50 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF6E3771F9E
MulDiv.KERNEL32 ref: 00007FF6E3771FB2
MulDiv.KERNEL32 ref: 00007FF6E3771FD3
SystemParametersInfoW.USER32 ref: 00007FF6E377201B
CreateFontIndirectW.GDI32 ref: 00007FF6E377202F
#380.COMCTL32 ref: 00007FF6E3772053
CreateWindowExW.USER32 ref: 00007FF6E37720A6
CreateWindowExW.USER32 ref: 00007FF6E3772100
CreateWindowExW.USER32 ref: 00007FF6E377215D
CreateWindowExW.USER32 ref: 00007FF6E37721BF
SendMessageW.USER32 ref: 00007FF6E37721DF
SendMessageW.USER32 ref: 00007FF6E37721F9
SendMessageW.USER32 ref: 00007FF6E3772218
SendMessageW.USER32 ref: 00007FF6E3772237
SendMessageW.USER32 ref: 00007FF6E3772255
SendMessageW.USER32 ref: 00007FF6E3772273
SendMessageW.USER32 ref: 00007FF6E3772291
SendMessageW.USER32 ref: 00007FF6E37722A9
SendMessageW.USER32 ref: 00007FF6E37722C1
GetClientRect.USER32 ref: 00007FF6E37722D0

Part of subcall function 00007FF6E37723F0: GetDC.USER32 ref: 00007FF6E377241B
Part of subcall function 00007FF6E37723F0: SelectObject.GDI32 ref: 00007FF6E3772462
Part of subcall function 00007FF6E37723F0: DrawTextW.USER32 ref: 00007FF6E3772485
Part of subcall function 00007FF6E37723F0: SelectObject.GDI32 ref: 00007FF6E377249B
Part of subcall function 00007FF6E37723F0: ReleaseDC.USER32 ref: 00007FF6E37724AB
Part of subcall function 00007FF6E37723F0: MoveWindow.USER32 ref: 00007FF6E37724FB
Part of subcall function 00007FF6E37723F0: MoveWindow.USER32 ref: 00007FF6E377253B
Part of subcall function 00007FF6E37723F0: MoveWindow.USER32 ref: 00007FF6E377258E

Strings

Close, xrefs: 00007FF6E3772168
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF6E3771F7D
BUTTON, xrefs: 00007FF6E3772176
STATIC, xrefs: 00007FF6E377205C, 00007FF6E37720B1
EDIT, xrefs: 00007FF6E377210B

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
Instruction ID: 61e36dd30c1106f22fc21342e641cc7e0e21128001dfafd81f8662abcc209809
Opcode Fuzzy Hash: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
Instruction Fuzzy Hash: FDA16937208B8586EB14CF21E45579ABB60F788B84F504229EB9D53B24CF7EE164CB48

Function 00007FF6E379471C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6E379476A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3794DD6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3794F4C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E379520A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E379542A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3795667
memcpy_s.LIBCPMT ref: 00007FF6E3795742
memcpy_s.LIBCPMT ref: 00007FF6E37957ED
memcpy_s.LIBCPMT ref: 00007FF6E37958BC

Strings

1#QNAN, xrefs: 00007FF6E3794883
1#SNAN, xrefs: 00007FF6E379487A
1#IND, xrefs: 00007FF6E3794857
1#INF, xrefs: 00007FF6E3794893

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 462ebf29a53f9f8e0898a565754c8078d18c0a01f6b8af8c35fed8b76f3e05ac
Instruction ID: bf3f0beb0f5b9c25761125f94276dc69305280cf12e75da04e2195f067f286ab
Opcode Fuzzy Hash: 462ebf29a53f9f8e0898a565754c8078d18c0a01f6b8af8c35fed8b76f3e05ac
Instruction Fuzzy Hash: 5CB2F673E182928BEB64CF64D4427FD3BA1FB44398F411235DA0DA7A84DF39A950CB49

Function 00007FF6E3778560 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF6E3772A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF6E377101D), ref: 00007FF6E3778587
FormatMessageW.KERNEL32 ref: 00007FF6E37785B6
WideCharToMultiByte.KERNEL32 ref: 00007FF6E377860C

Part of subcall function 00007FF6E37729E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6E37787F2,?,?,?,?,?,?,?,?,?,?,?,00007FF6E377101D), ref: 00007FF6E3772A14
Part of subcall function 00007FF6E37729E0: MessageBoxW.USER32 ref: 00007FF6E3772AF0

Strings

WideCharToMultiByte, xrefs: 00007FF6E377861D
No error messages generated., xrefs: 00007FF6E37785C0
FormatMessageW, xrefs: 00007FF6E37785C7
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF6E3778629
Failed to encode wchar_t as UTF-8., xrefs: 00007FF6E3778616
PyInstaller: FormatMessageW failed., xrefs: 00007FF6E37785D3

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
Instruction ID: b9510b60de2721e52b34a1fcb8f700cf43b22a64fb9551b22c946fc7c8aab5de
Opcode Fuzzy Hash: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
Instruction Fuzzy Hash: 3C219D32A0CA4291FF608F11E84637A3AA1FF88385F840135D54DE26E4EF3DD125870E

Function 00007FF6E377C57C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6E377C598
RtlCaptureContext.KERNEL32 ref: 00007FF6E377C5C5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6E377C5DF
RtlVirtualUnwind.KERNEL32 ref: 00007FF6E377C620
IsDebuggerPresent.KERNEL32 ref: 00007FF6E377C674
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6E377C695
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6E377C6A0

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
Instruction ID: f13cf108e23e4db18b49688dd1d41d636f42ebc1b4b0405d073232704f7ad486
Opcode Fuzzy Hash: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
Instruction Fuzzy Hash: E8317073608B8286EB609F60E8413ED3B60FB88744F44413ADA4E97B94DF39D258C709

Function 00007FF6E378ABD8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6E378AC51
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6E378AC69
RtlVirtualUnwind.KERNEL32 ref: 00007FF6E378ACA4
IsDebuggerPresent.KERNEL32 ref: 00007FF6E378ACDD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6E378ACE7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6E378ACF2

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
Instruction ID: d4fb5e1530373bf4931b690e1c9c0fae37291a641742c496030ce13927b56676
Opcode Fuzzy Hash: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
Instruction Fuzzy Hash: BD317433608B8186DB60CF25E8413AE7BA0FB88794F500235EA8D93B98DF3DD555CB09

Function 00007FF6E3791EE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3791F30
FindFirstFileExW.KERNEL32 ref: 00007FF6E379203A

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
Instruction ID: 35b21276e3cf7b019d4e71e9495f2e416ee7ef0f203b7cfa15917eec3f2ecc5d
Opcode Fuzzy Hash: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
Instruction Fuzzy Hash: EEB1D723B1869A41EE60AF2598023B97B51EB44BD4F464231EE4DA7BC5DF3DE461C30D

Function 00007FF6E377C460 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6E377C48C
GetCurrentThreadId.KERNEL32 ref: 00007FF6E377C49A
GetCurrentProcessId.KERNEL32 ref: 00007FF6E377C4A6
QueryPerformanceCounter.KERNEL32 ref: 00007FF6E377C4B6

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
Instruction ID: d93723089c5ea6804565f532b9c5a8c5a165cd73453e7f88cdc7f67cc3294320
Opcode Fuzzy Hash: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
Instruction Fuzzy Hash: 8B115E22B14F0589EF00CF60E8553BD37A4FB58758F040E31DA6D9ABA4DF78D1A48384

Function 00007FF6E3794280 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6E37942E6
memcpy_s.LIBCPMT ref: 00007FF6E3794311

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 6cd81152c4805d39075c3f67a0b83bb41ca91ee551b28a922870c69117b00a4a
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 4FC1F673B192C587DB24CF59A04576ABBA1F798784F468234DB4AA3744DF3EE850CB08

Function 00007FF6E3799FF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6E379A247
RaiseException.KERNEL32 ref: 00007FF6E379A258

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: b4cdb5d9b405a5f2b155a4653528c407a9956d0b6218a393af626003cf1b5a24
Instruction ID: fb1987b9d291dc01f583c5e0f26a7f9f8cf3be80654d66581374cb7974a843c0
Opcode Fuzzy Hash: b4cdb5d9b405a5f2b155a4653528c407a9956d0b6218a393af626003cf1b5a24
Instruction Fuzzy Hash: 98B14F73605B898BEB55CF29C84636C3BA0F784B48F168921DB9D877A4CF3AD461C709

Function 00007FF6E37788D0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF6E3778901
FindClose.KERNEL32 ref: 00007FF6E3778910

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
Instruction ID: b39ffa3934f60a06d2bf54e76a27683d7ad1d376329fc14b32fc4632dfc9d4a6
Opcode Fuzzy Hash: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
Instruction Fuzzy Hash: 34F0A433A1C78586FB608F64F44A77A7B90EB84764F004335D66D526D4EF3CD0288A09

Function 00007FF6E3783AE4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6E3783E94
, xrefs: 00007FF6E3783C52

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 631a3e48eb673e1850d57232dc56befdf755ff5fd67b38a64b6ca9c49a913018
Instruction ID: f6983e957c8fc418229771d4e2119bfe2a23cfb2decabcb459b8c1ad59a45910
Opcode Fuzzy Hash: 631a3e48eb673e1850d57232dc56befdf755ff5fd67b38a64b6ca9c49a913018
Instruction Fuzzy Hash: 85E1B53BA0866681FF688A1D805223D3BA0EF45B58F145135DE0EA77D4DF2BE861C74E

Function 00007FF6E378E4B0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF6E378E5BD
gfff, xrefs: 00007FF6E378E63A

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 95f5c728ca916dfdd01defb08dd518f9d9b28e517fc4b7b4370436378f7798ef
Instruction ID: 55b51123795f7a63d5dd8d1ceb8c7dcdccffbada9622b7b714e3f72ed9e04e4b
Opcode Fuzzy Hash: 95f5c728ca916dfdd01defb08dd518f9d9b28e517fc4b7b4370436378f7798ef
Instruction Fuzzy Hash: FA518C23B182E546EB248E359906769BF91E784B94F488231CBACD7EC5DF3ED450870A

Function 00007FF6E378E01C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6E378E35E

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
Instruction ID: 106506a9ccb7a3cc36ecd3d09b9aedff9f240a98b803faa5f1226b47a8887997
Opcode Fuzzy Hash: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
Instruction Fuzzy Hash: B6A14563A0879586EF21CB25A4017ADBF91AB957C4F049131DE8D97B81DF3EE911C30A

Function 00007FF6E37886D0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF6E37886EF

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: cf0abd2c7e4acdbc7dd987358b9028f2a59d8daca936b72b1b12d96a797a3aac
Instruction ID: 5bbd4cbf6ee4e86983891baa3279474918776ac73c9c2b4e908de0984255a3f8
Opcode Fuzzy Hash: cf0abd2c7e4acdbc7dd987358b9028f2a59d8daca936b72b1b12d96a797a3aac
Instruction Fuzzy Hash: 1651D403F0866251FE64AA66591337A7AA16F44BC4F084538DE0DE77D1EF3EE472820E

Function 00007FF6E3793AF0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6E3793AF4

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2a498131316ba0cf2da72d1126b97be92acaa4b08e35d008cc1bd8d186f782f7
Instruction ID: bb5124d78ddb51202478757c72bd001067f9be50234c3566374ba4b2f1a9d792
Opcode Fuzzy Hash: 2a498131316ba0cf2da72d1126b97be92acaa4b08e35d008cc1bd8d186f782f7
Instruction Fuzzy Hash: 9AB09221E0BA4AC2EF486B216C873143AA67F48B00FA54138C10DA1320DE2D20B5470A

Function 00007FF6E37836E0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 208e6a978d65b3df04c2d2163cfe11b9ca3e791e60348233d6b397c6ac133608
Instruction ID: 7f0b9cf8bc11b3f7a428bed47f1c80bb21cf29d9a855a842f88949b673c8e37f
Opcode Fuzzy Hash: 208e6a978d65b3df04c2d2163cfe11b9ca3e791e60348233d6b397c6ac133608
Instruction Fuzzy Hash: 9BD1E76BA0866285FF688A2D805237D3BA0EF05B48F144635CE0DA7694CF3FD865D74E

Function 00007FF6E3778FD0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926518188b614a96dab23eca74cd6fab0ac352dd7b9dabb22d14e7e66e5c8c54
Instruction ID: 8d2bb4d4ed539f17bd20322a0f9013ae32e7f74e69d225e6319f31e8ae77a346
Opcode Fuzzy Hash: 926518188b614a96dab23eca74cd6fab0ac352dd7b9dabb22d14e7e66e5c8c54
Instruction Fuzzy Hash: ECC125332141F44BDA98EB29E45947A37E1F7A930ABD5403AEB878B7C1CA3DE414D750

Function 00007FF6E3782D50 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67fe5c4df14f10fbabbc179396d5558260dc0a4d214c0f6109c6307dd6f74d9
Instruction ID: 0f03500189c71dcb52b9212d060ddc275480479b2d0236d7190d22a3c1dfb1c9
Opcode Fuzzy Hash: b67fe5c4df14f10fbabbc179396d5558260dc0a4d214c0f6109c6307dd6f74d9
Instruction Fuzzy Hash: A7B15B779086A585EB658F29C05533C3FA1EB49F48F244235CA8EA7395CF3AD461C70E

Function 00007FF6E378EB30 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41de09fd609196546d8b05baa0994189bc53ea50dddfb86cdccda31fca7eba1c
Instruction ID: 2414b69e3da6e5fe7c091ce7e48f96146f37d40d7e09edf507b22695133a54dc
Opcode Fuzzy Hash: 41de09fd609196546d8b05baa0994189bc53ea50dddfb86cdccda31fca7eba1c
Instruction Fuzzy Hash: 7A81F373A0C79146EB748B19948237ABE91FB857D4F044235DA8DA3F89DF3ED0508B09

Function 00007FF6E3796D70 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 14e965909f7280d7a3652a0ca181d92c694a9cf8fd4ee26df7ecbe6e2bc61af1
Instruction ID: 504cc6e19cb0784402ce918c9f4b350526726d5650444239636c5dbb777110c0
Opcode Fuzzy Hash: 14e965909f7280d7a3652a0ca181d92c694a9cf8fd4ee26df7ecbe6e2bc61af1
Instruction Fuzzy Hash: E261A623A1C2928AFF648E2884527797A92BF40770F170739E61DD66C5DE7FE811860E

Function 00007FF6E3781A84 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction ID: 1eaa71c3edc915da1b3e813032cf146da68fe5c07833e570ec1ed0dbc4fa93f6
Opcode Fuzzy Hash: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction Fuzzy Hash: D8518977A186A186EB248F29C0463793BA0EB45B58F244131CE4DA7794DF3BE863C74D

Function 00007FF6E37822A4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction ID: b7a55ba12584498e146daf99879cb2499d03788e8532e44144eb6990acacea28
Opcode Fuzzy Hash: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction Fuzzy Hash: 16519637A1866181EB248B29D05533C3BA0EB59B59F245131CE4DA7B94CF3BEC62C749

Function 00007FF6E3781E94 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction ID: 1431de68ed4fd9fb72e11b6c1973b318d1bfeb02a01b546f86c5dd941e70ff13
Opcode Fuzzy Hash: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction Fuzzy Hash: 0951A437A196A1C6EB248B29C0453393BA0EB44B59F244131DE4CA7795DF3BE863C749

Function 00007FF6E3781C90 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction ID: 4bf463480e8c42e89450552662b5f5a0799858e2b6c1adebfafcc10310a21966
Opcode Fuzzy Hash: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction Fuzzy Hash: C2518637A186A185EB248B29D0517383BA1EB44B5DF244131CE4DB7794CF3BE863C749

Function 00007FF6E3781880 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction ID: 201f51ddb1c8aec82577ef5f851a6947c18a3fca97f669513ac3bd468c045cd4
Opcode Fuzzy Hash: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction Fuzzy Hash: 1A51A833A186E186EB248B29C0467783BA1EB45B58F254131CE4DA7794CF3FE863D749

Function 00007FF6E37820A0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction ID: 02e1385406a54427c7d9ddc5f7d45f04cb46159764cde88c5adfc0b4a0735eee
Opcode Fuzzy Hash: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction Fuzzy Hash: 6B519137A1866585EB648B29C0423383BA1EB48B59F344131CF4DA7798CF3BE862C749

Function 00007FF6E3785F30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: c5ff4a6c6141a5b4eba86f33c56244195529c80a7795359ad9bd0c4c568784cd
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 2841C35381D77E84ED6589180501BB43E909F227B0E5852B4DE9DB73C6CE1F29A6820F

Function 00007FF6E378A430 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2970ddd5f501fe71afef01217e103934546d8fb7f20af68bec1b913dc8647c23
Instruction ID: f7ecbb82ce2e726a9442283a52c0239cbefe155cb73c9df63cbeae27dd37b8ff
Opcode Fuzzy Hash: 2970ddd5f501fe71afef01217e103934546d8fb7f20af68bec1b913dc8647c23
Instruction Fuzzy Hash: 2141F563B14A5581FF54CF2AD91526AB7A1AB48FD0B099032EE4DD7B58DE3DD0928308

Function 00007FF6E3787C98 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b002bbc49f8edc76fb8066870c38d7afee558bd2249c300808c44e7bc92a50
Instruction ID: 4ae10647d284a67e8c005447b43afc6c0e1bfa2fc1e85d30ab9cc20831a27552
Opcode Fuzzy Hash: d2b002bbc49f8edc76fb8066870c38d7afee558bd2249c300808c44e7bc92a50
Instruction Fuzzy Hash: 7731C733718B9281EB549F2564422797AD4AB84BA0F044238EA4EB3796DF3DD021830D

Function 00007FF6E3799E40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dada551c461b21fdad657b6bac4cbdfad31b05eb9b59333086b2e0a15b162055
Instruction ID: 6a16879b719ae57f821ebc971a66ba47f39420041f17d2db1f817b7f64f5bc76
Opcode Fuzzy Hash: dada551c461b21fdad657b6bac4cbdfad31b05eb9b59333086b2e0a15b162055
Instruction Fuzzy Hash: 51F044726182558ADB948F29A4037297BE1E748380B448079D589C7E18DA3D94608F19

Function 00007FF6E377C760 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5749315d7b24dceccc8714b5042f108a7de79c1631c17c6a95dc8ed6b888950b
Instruction ID: 076c4a997e255b934a00318fa1618de4e02f5d1fb0f4f62c67e973535bf06c51
Opcode Fuzzy Hash: 5749315d7b24dceccc8714b5042f108a7de79c1631c17c6a95dc8ed6b888950b
Instruction Fuzzy Hash: 22A00162948806D1EA448B50A8522B03A20EB55302B510136D00EA10A09F2EA561824E

Function 00007FF6E3776EF0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6E3776F07
GetProcAddress.KERNEL32 ref: 00007FF6E3776F46
GetProcAddress.KERNEL32 ref: 00007FF6E3776F6B
GetProcAddress.KERNEL32 ref: 00007FF6E3776F90
GetProcAddress.KERNEL32 ref: 00007FF6E3776FB8
GetProcAddress.KERNEL32 ref: 00007FF6E3776FE0
GetProcAddress.KERNEL32 ref: 00007FF6E3777008
GetProcAddress.KERNEL32 ref: 00007FF6E3777030
GetProcAddress.KERNEL32 ref: 00007FF6E3777058

Strings

Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF6E377706A
Failed to get address for Tcl_Alloc, xrefs: 00007FF6E3777362
Failed to get address for Tcl_EvalFile, xrefs: 00007FF6E37772EA
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF6E377715A
Failed to get address for Tcl_Finalize, xrefs: 00007FF6E3776FCA
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF6E37772C2
Failed to get address for Tcl_SetVar2, xrefs: 00007FF6E37771D2
Failed to get address for Tcl_CreateThread, xrefs: 00007FF6E3777042
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF6E37773DA
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF6E3776F7D
Tcl_ThreadQueueEvent, xrefs: 00007FF6E377713E
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF6E377710A
Tcl_NewByteArrayObj, xrefs: 00007FF6E3777256
Tcl_Free, xrefs: 00007FF6E377736E
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF6E3777132
Tcl_CreateInterp, xrefs: 00007FF6E3776F3C
Tcl_EvalEx, xrefs: 00007FF6E37772F6
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF6E37770BA
Tcl_NewStringObj, xrefs: 00007FF6E377722E
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF6E37771FA
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF6E3776FA2
Tcl_DoOneEvent, xrefs: 00007FF6E3776F86
Tcl_Alloc, xrefs: 00007FF6E3777346
Tcl_GetObjResult, xrefs: 00007FF6E37772A6
Tcl_GetString, xrefs: 00007FF6E3777206
Failed to get address for Tk_Init, xrefs: 00007FF6E37773B2
Tcl_FinalizeThread, xrefs: 00007FF6E3776FD6
GetProcAddress, xrefs: 00007FF6E3776F20
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF6E3776F58
Tcl_ThreadAlert, xrefs: 00007FF6E3777166
Tcl_SetVar2, xrefs: 00007FF6E37771B6
Tk_Init, xrefs: 00007FF6E3777396
Failed to get address for Tcl_EvalEx, xrefs: 00007FF6E3777312
Tcl_MutexLock, xrefs: 00007FF6E3777076
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF6E3777272
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF6E3777182
Failed to get address for Tcl_MutexLock, xrefs: 00007FF6E3777092
Tk_GetNumMainWindows, xrefs: 00007FF6E37773BE
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF6E377733A
Failed to get address for Tcl_GetVar2, xrefs: 00007FF6E37771AA
Tcl_Init, xrefs: 00007FF6E3776F00
Tcl_Finalize, xrefs: 00007FF6E3776FAE
Tcl_ConditionNotify, xrefs: 00007FF6E37770EE
Tcl_FindExecutable, xrefs: 00007FF6E3776F61
Tcl_EvalObjv, xrefs: 00007FF6E377731E
Tcl_ConditionFinalize, xrefs: 00007FF6E37770C6
Failed to get address for Tcl_Init, xrefs: 00007FF6E3776F19
Tcl_SetVar2Ex, xrefs: 00007FF6E377727E
Tcl_GetCurrentThread, xrefs: 00007FF6E377704E
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF6E377701A
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF6E3776FF2
Tcl_ConditionWait, xrefs: 00007FF6E3777116
Tcl_GetVar2, xrefs: 00007FF6E377718E
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF6E377724A
Failed to get address for Tcl_GetString, xrefs: 00007FF6E3777222
Tcl_EvalFile, xrefs: 00007FF6E37772CE
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF6E37770E2
Tcl_CreateObjCommand, xrefs: 00007FF6E37771DE
Tcl_CreateThread, xrefs: 00007FF6E3777026
Tcl_MutexUnlock, xrefs: 00007FF6E377709E
Failed to get address for Tcl_Free, xrefs: 00007FF6E377738A
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF6E377729A
Tcl_DeleteInterp, xrefs: 00007FF6E3776FFE

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
Instruction ID: 5d449bde283b899a30b8ceba19cabbc586f5c0ea64afc5bc6851a2e978c56929
Opcode Fuzzy Hash: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
Instruction Fuzzy Hash: AFE1D963A0DB03D0FE158F08A8533757FA5AF44791B865235C80DA66A8EF7EF564830E

Function 00007FF6E37712B0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3772B30: MessageBoxW.USER32 ref: 00007FF6E3772C05

_fread_nolock.LIBCMT ref: 00007FF6E3771499

Strings

%s%c%s, xrefs: 00007FF6E37713EE
malloc, xrefs: 00007FF6E3771377
fseek, xrefs: 00007FF6E3771332
\, xrefs: 00007FF6E37713F5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6E377132B
fread, xrefs: 00007FF6E37714C6
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6E37714BF
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6E37712FE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6E3771370

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Message_fread_nolock
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 3065259568-2316137593
Opcode ID: b33f58b5d6ae28b15dfa25b64e3fbd1b1934ea115dda0f842008646e6ef0f35a
Instruction ID: 006cb06cdba937c8e5b3bc065e3f83213ce828bef2a97c580d361ffb30e5be6d
Opcode Fuzzy Hash: b33f58b5d6ae28b15dfa25b64e3fbd1b1934ea115dda0f842008646e6ef0f35a
Instruction Fuzzy Hash: 2151D323A0868345EE20AB11A8527FA3B94EF447C5F404131EE4DA7BC5EE7EE551C34E

Function 00007FF6E37723F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6E377241B
SelectObject.GDI32 ref: 00007FF6E3772462
DrawTextW.USER32 ref: 00007FF6E3772485
SelectObject.GDI32 ref: 00007FF6E377249B
ReleaseDC.USER32 ref: 00007FF6E37724AB
MoveWindow.USER32 ref: 00007FF6E37724FB
MoveWindow.USER32 ref: 00007FF6E377253B
MoveWindow.USER32 ref: 00007FF6E377258E
MoveWindow.USER32 ref: 00007FF6E37725D6

Strings

P%, xrefs: 00007FF6E377246F

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
Instruction ID: 45f90911eafcfb3e69b3711281e93f035358e46155d344af0ffc097bd80e9139
Opcode Fuzzy Hash: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
Instruction Fuzzy Hash: 605119276047A186DA349F26F0182BABBA1F798B61F004121EFDE83794DF3DD095DB14

Function 00007FF6E37867A4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E37867E7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3786BD4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3786E70

Strings

p, xrefs: 00007FF6E3786899
f, xrefs: 00007FF6E3786909
:, xrefs: 00007FF6E37869A0
-, xrefs: 00007FF6E378687D
p, xrefs: 00007FF6E3786911

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
Instruction ID: bbc33f47e0a525c743d117152a6f5188b898c306a90150c29eff9e185e05581b
Opcode Fuzzy Hash: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
Instruction Fuzzy Hash: F712E363E0C163A2FF205A18F1467B97E91EB40754F954035E789A76C4DF3EE4A08B1E

Function 00007FF6E3781108 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3781148
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3781510
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E37817AF

Strings

f, xrefs: 00007FF6E3781395
f, xrefs: 00007FF6E378124A
p, xrefs: 00007FF6E37811ED
p, xrefs: 00007FF6E3781252
f, xrefs: 00007FF6E37811E0

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction ID: dcabadaaffc9fbb8dd8d644d5645132ae4b90596ecd5962ed857f863ed512070
Opcode Fuzzy Hash: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction Fuzzy Hash: 4C129163E0C1E386FF609A15E0167B97B51EB40750F944139E69AE66C4DF3EE4A0CB0E

Function 00007FF6E37715A0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF6E3771640
fseek, xrefs: 00007FF6E3771610
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6E3771609
fread, xrefs: 00007FF6E37716C9
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6E37716C2
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6E37715D3
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6E3771639

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 60800b8341f6ed6232bf3c08ce047e3bb6bf7a72e4122de6b6d496988eda1446
Instruction ID: 954c670670df018faa24c078c485b5e9cb15c64ca3c2f0ed84a213df60ecfa4b
Opcode Fuzzy Hash: 60800b8341f6ed6232bf3c08ce047e3bb6bf7a72e4122de6b6d496988eda1446
Instruction Fuzzy Hash: C631D623B0864385EE20DB11A4027BA7B50FF047C4F484131DE4DE7A95EE3EE465870E

Function 00007FF6E377EB00 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6E377EB5D

Part of subcall function 00007FF6E377FA70: __GetUnwindTryBlock.LIBCMT ref: 00007FF6E377FAB3
Part of subcall function 00007FF6E377FA70: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6E377FAD8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6E377EC35
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6E377EE8A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6E377EF96

Strings

csm, xrefs: 00007FF6E377EC58
csm, xrefs: 00007FF6E377EBDE
csm, xrefs: 00007FF6E377EB77

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
Instruction ID: f4eec78473ee346509a6e3d7c15cafb28b3114ae4d8f8a18afbc84aa68ee261d
Opcode Fuzzy Hash: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
Instruction Fuzzy Hash: 80E19E33A0874186EF609B2594423AD7BA0FB857C9F100535EE4DA7F95CF39E1A1C70A

Function 00007FF6E378F1D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6E378F56A,?,?,000002C5B136AB08,00007FF6E378B317,?,?,?,00007FF6E378B20E,?,?,?,00007FF6E3786452), ref: 00007FF6E378F34C
GetProcAddress.KERNEL32(?,?,?,00007FF6E378F56A,?,?,000002C5B136AB08,00007FF6E378B317,?,?,?,00007FF6E378B20E,?,?,?,00007FF6E3786452), ref: 00007FF6E378F358

Strings

ext-ms-, xrefs: 00007FF6E378F2A9
api-ms-, xrefs: 00007FF6E378F296

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
Instruction ID: dec55fd5d16d44a2ecaa3331adc54e65434331e4fd0010a488a0842579bfb1b3
Opcode Fuzzy Hash: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
Instruction Fuzzy Hash: A641F223B19A1241EE15CB16E8067793A91BF48BA0F594135DD0DF7B84EE3EE469C30E

Function 00007FF6E37786B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6E377101D), ref: 00007FF6E3778747
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6E377101D), ref: 00007FF6E377879E

Strings

WideCharToMultiByte, xrefs: 00007FF6E37787E6
Out of memory., xrefs: 00007FF6E37787CF
Failed to get UTF-8 buffer size., xrefs: 00007FF6E37787DF
Failed to encode wchar_t as UTF-8., xrefs: 00007FF6E37787C6
win32_utils_to_utf8, xrefs: 00007FF6E37787D6

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 3d8cc197ee630c3fb00dd31b72f24074ca9fe52add05c6a83a64952da4f63ba4
Instruction ID: b75b614b4252bbb24cac8a2b66d4cc07a37116682ad7bc97b241c66c8b1373f6
Opcode Fuzzy Hash: 3d8cc197ee630c3fb00dd31b72f24074ca9fe52add05c6a83a64952da4f63ba4
Instruction Fuzzy Hash: AA418433A08B9282DA20CF55F84227ABAA1FB44790F544139DA8DA7B94DF3DD465C70D

Function 00007FF6E3778BF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF6E37739EA), ref: 00007FF6E3778C31

Part of subcall function 00007FF6E37729E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6E37787F2,?,?,?,?,?,?,?,?,?,?,?,00007FF6E377101D), ref: 00007FF6E3772A14
Part of subcall function 00007FF6E37729E0: MessageBoxW.USER32 ref: 00007FF6E3772AF0

WideCharToMultiByte.KERNEL32(?,00007FF6E37739EA), ref: 00007FF6E3778CA5

Strings

WideCharToMultiByte, xrefs: 00007FF6E3778C45, 00007FF6E3778CB6
Out of memory., xrefs: 00007FF6E3778C6B
Failed to get UTF-8 buffer size., xrefs: 00007FF6E3778C3E
Failed to encode wchar_t as UTF-8., xrefs: 00007FF6E3778CAF
win32_utils_to_utf8, xrefs: 00007FF6E3778C72

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 93215b2962e715be9f5aa91d99be70836a612e16585fb8aee950a2577366c4a3
Instruction ID: 53b99924ae531097f65afda40ab901f44fb5525a230214379a9ea3a82dc80411
Opcode Fuzzy Hash: 93215b2962e715be9f5aa91d99be70836a612e16585fb8aee950a2577366c4a3
Instruction Fuzzy Hash: 8B217133A09B42D5EE10DF16E8422797AE1EB84B80F584236D64DA3794EF3DE521834D

Function 00007FF6E37775A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6E3777716

Part of subcall function 00007FF6E3780250: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3780264

Part of subcall function 00007FF6E3780224: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3780238

Strings

%s%c%s, xrefs: 00007FF6E37775E5
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6E3777632
ERROR: file already exists but should not: %s, xrefs: 00007FF6E377767C
\, xrefs: 00007FF6E37775EC
WARNING: file already exists but should not: %s, xrefs: 00007FF6E3777698

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: 755b687bb57b6196ddf589ec1dc1e09ba6bb635f149e2384a6072683996534de
Instruction ID: 7a26559daaf99184cf45a44a805fd0e965d3aa0b047284dcfc62e3abe724083d
Opcode Fuzzy Hash: 755b687bb57b6196ddf589ec1dc1e09ba6bb635f149e2384a6072683996534de
Instruction Fuzzy Hash: 0951AF23A0D68341FE209B2599433F97A91DF85BD1F444134E90DE76DAEE6FE421838E

Function 00007FF6E3777420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3778AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3772ABB), ref: 00007FF6E3778B1A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF6E37779A1,00000000,?,00000000,00000000,?,00007FF6E377154F), ref: 00007FF6E377747F

Part of subcall function 00007FF6E3772B30: MessageBoxW.USER32 ref: 00007FF6E3772C05

Strings

LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6E3777493
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6E37774DA
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6E3777456

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 5e8575f0beacdb372a81e9debe9bb6d766e8e255e7029f60019f70bf69282784
Instruction ID: 67021632f7ed7ff82076ee2948aee17e0e77631bb7d2aca09272f9b927526de1
Opcode Fuzzy Hash: 5e8575f0beacdb372a81e9debe9bb6d766e8e255e7029f60019f70bf69282784
Instruction Fuzzy Hash: 7D31CA13B1C78240FE209B15D5573BA7991EF587C1F440431DA4EE27D6FD2EE124860E

Function 00007FF6E377DDB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6E377E06A,?,?,?,00007FF6E377DD5C,?,?,00000001,00007FF6E377D979), ref: 00007FF6E377DE3D
GetLastError.KERNEL32(?,?,?,00007FF6E377E06A,?,?,?,00007FF6E377DD5C,?,?,00000001,00007FF6E377D979), ref: 00007FF6E377DE4B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6E377E06A,?,?,?,00007FF6E377DD5C,?,?,00000001,00007FF6E377D979), ref: 00007FF6E377DE75
FreeLibrary.KERNEL32(?,?,?,00007FF6E377E06A,?,?,?,00007FF6E377DD5C,?,?,00000001,00007FF6E377D979), ref: 00007FF6E377DEBB
GetProcAddress.KERNEL32(?,?,?,00007FF6E377E06A,?,?,?,00007FF6E377DD5C,?,?,00000001,00007FF6E377D979), ref: 00007FF6E377DEC7

Strings

api-ms-, xrefs: 00007FF6E377DE5D

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
Instruction ID: 9b35c3e39fca6f38c76308938fa8304c230a6b61e933446cb6c0989135e81e9c
Opcode Fuzzy Hash: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
Instruction Fuzzy Hash: 0131B423A2A64681EE129B02980277A3BD4FF58B61F5A0535DD1DA73D0DF7DE464830E

Function 00007FF6E3778AE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3772ABB), ref: 00007FF6E3778B1A

Part of subcall function 00007FF6E37729E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6E37787F2,?,?,?,?,?,?,?,?,?,?,?,00007FF6E377101D), ref: 00007FF6E3772A14
Part of subcall function 00007FF6E37729E0: MessageBoxW.USER32 ref: 00007FF6E3772AF0

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3772ABB), ref: 00007FF6E3778BA0

Strings

Out of memory., xrefs: 00007FF6E3778B62
MultiByteToWideChar, xrefs: 00007FF6E3778B2E, 00007FF6E3778BB1
Failed to decode wchar_t from UTF-8, xrefs: 00007FF6E3778BAA
Failed to get wchar_t buffer size., xrefs: 00007FF6E3778B27
win32_utils_from_utf8, xrefs: 00007FF6E3778B69

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: 2a7f0904e5ec1897560545d2159a663e9c273eaf1fea03a0d1ae7df506dc6c73
Instruction ID: cfdd0826f37fe5aa41d0c2e6b7171d9d0b770ae04358994d2193467a1050b0e7
Opcode Fuzzy Hash: 2a7f0904e5ec1897560545d2159a663e9c273eaf1fea03a0d1ae7df506dc6c73
Instruction Fuzzy Hash: F1218623B0864191EF50CB15F842276BBA1FB847C4F484235DA5CE3BA5EE2DD551870D

Function 00007FF6E378B710 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6E378B71F
FlsGetValue.KERNEL32 ref: 00007FF6E378B734
FlsSetValue.KERNEL32 ref: 00007FF6E378B755
FlsSetValue.KERNEL32 ref: 00007FF6E378B782
FlsSetValue.KERNEL32 ref: 00007FF6E378B793
FlsSetValue.KERNEL32 ref: 00007FF6E378B7A4
SetLastError.KERNEL32 ref: 00007FF6E378B7BF

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5e25a57dc3899cb5d9e1114fbc8c557aa55031a2469902f6cab5e8a78f8e35b9
Instruction ID: 191e2358239cbdfac49b27fbf9fd2a2982b6a58f9f80288bf3187bbe5da9eb8e
Opcode Fuzzy Hash: 5e25a57dc3899cb5d9e1114fbc8c557aa55031a2469902f6cab5e8a78f8e35b9
Instruction Fuzzy Hash: 6E216D26B0936241FE646731AA573397E415F447B0F140739D93DE6BC6DE2EE421860F

Function 00007FF6E37985BC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6E37985ED
GetLastError.KERNEL32 ref: 00007FF6E37985F9
CloseHandle.KERNEL32 ref: 00007FF6E3798611
CreateFileW.KERNEL32 ref: 00007FF6E379863C
WriteConsoleW.KERNEL32 ref: 00007FF6E379865B

Strings

CONOUT$, xrefs: 00007FF6E379861D

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
Instruction ID: 12b844729accd4522f9e29fcfe32686ac43e284f6106cd6a730c218b29027fff
Opcode Fuzzy Hash: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
Instruction Fuzzy Hash: CC11B123A18A4186EB508F42E8557297AA0FB88FE0F010334DA1ED77A4DF3DD824874D

Function 00007FF6E378B888 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6E37854CD,?,?,?,?,00007FF6E378F1BF,?,?,00000000,00007FF6E378B9A6,?,?,?), ref: 00007FF6E378B897
FlsSetValue.KERNEL32(?,?,?,00007FF6E37854CD,?,?,?,?,00007FF6E378F1BF,?,?,00000000,00007FF6E378B9A6,?,?,?), ref: 00007FF6E378B8CD
FlsSetValue.KERNEL32(?,?,?,00007FF6E37854CD,?,?,?,?,00007FF6E378F1BF,?,?,00000000,00007FF6E378B9A6,?,?,?), ref: 00007FF6E378B8FA
FlsSetValue.KERNEL32(?,?,?,00007FF6E37854CD,?,?,?,?,00007FF6E378F1BF,?,?,00000000,00007FF6E378B9A6,?,?,?), ref: 00007FF6E378B90B
FlsSetValue.KERNEL32(?,?,?,00007FF6E37854CD,?,?,?,?,00007FF6E378F1BF,?,?,00000000,00007FF6E378B9A6,?,?,?), ref: 00007FF6E378B91C
SetLastError.KERNEL32(?,?,?,00007FF6E37854CD,?,?,?,?,00007FF6E378F1BF,?,?,00000000,00007FF6E378B9A6,?,?,?), ref: 00007FF6E378B937

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 941158fb4e6d3a9375e13d6d10033e8ffcdbbced4d4dd5e625aa307a16b34608
Instruction ID: 1040af637d299d7d2f1e67b11e2f1b3ae2797078ce6c1124ce63704a7348368b
Opcode Fuzzy Hash: 941158fb4e6d3a9375e13d6d10033e8ffcdbbced4d4dd5e625aa307a16b34608
Instruction Fuzzy Hash: 76116F22B0D66281FE545731A9573397E519F887B0F540734E83EE66C6DE2EE422870F

Function 00007FF6E377D778 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6E377D7A3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6E377D838
RtlUnwindEx.KERNEL32 ref: 00007FF6E377D887

Strings

csm, xrefs: 00007FF6E377D81E
f, xrefs: 00007FF6E377D7B6

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
Instruction ID: ee5c88851e53f69915968b17a45e2a23a8cd140c685b8b917e27b85a5bf6e453
Opcode Fuzzy Hash: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
Instruction Fuzzy Hash: 0F51C233A192028AEF54CF15E405B3A3BD5FB84B95F118534DA5EA7788DF3AE8508B0D

Function 00007FF6E3772600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF6E37727EF), ref: 00007FF6E3772638
DialogBoxIndirectParamW.USER32 ref: 00007FF6E37726FC
DeleteObject.GDI32 ref: 00007FF6E377272F
DestroyIcon.USER32 ref: 00007FF6E3772741

Strings

Unhandled exception in script, xrefs: 00007FF6E3772668

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: ef2f79dabe8b940bf64869f24e404b0ac86445532df2e67e8084f44f9f65f5c2
Instruction ID: f07dd659d1f4cb109aa3ea7625ac4ea7d66bebdecac483a02647e357e4f92cf3
Opcode Fuzzy Hash: ef2f79dabe8b940bf64869f24e404b0ac86445532df2e67e8084f44f9f65f5c2
Instruction Fuzzy Hash: B6316D33608A8284EF20DF25E8562F97BA0FF88784F400135EA4D9BA99DF3DD115C70A

Function 00007FF6E37729E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6E37787F2,?,?,?,?,?,?,?,?,?,?,?,00007FF6E377101D), ref: 00007FF6E3772A14

Part of subcall function 00007FF6E3778560: GetLastError.KERNEL32(00000000,00007FF6E3772A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF6E377101D), ref: 00007FF6E3778587
Part of subcall function 00007FF6E3778560: FormatMessageW.KERNEL32 ref: 00007FF6E37785B6

Part of subcall function 00007FF6E3778AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3772ABB), ref: 00007FF6E3778B1A

MessageBoxW.USER32 ref: 00007FF6E3772AF0
MessageBoxA.USER32 ref: 00007FF6E3772B0C

Strings

Fatal error detected, xrefs: 00007FF6E3772AC6, 00007FF6E3772AFE
%s%s: %s, xrefs: 00007FF6E3772A6B

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
Instruction ID: dab5d6b5b5eac5b5fecf2f0db9b70f7b404800de46b9ba351ffdb3d4d6b4745b
Opcode Fuzzy Hash: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
Instruction Fuzzy Hash: C831A67362868591EA30DB10E4427EA7BA4FF847C4F404136E68DA3A99DF3DD215CB4D

Function 00007FF6E378A018 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6E378A03D
GetProcAddress.KERNEL32 ref: 00007FF6E378A053
FreeLibrary.KERNEL32 ref: 00007FF6E378A07A

Strings

CorExitProcess, xrefs: 00007FF6E378A04C
mscoree.dll, xrefs: 00007FF6E378A034

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
Instruction ID: 3f9370e12f9e84d1b55a821b412b6001f190ac0c790ab47c99491469b8cef4c1
Opcode Fuzzy Hash: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
Instruction Fuzzy Hash: 38F0AF22A0860681EF508F24E8463797B60EF887A1F540335C5AE961E4DF2ED098C30E

Function 00007FF6E3799C40 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6E3799C68
_set_statfp.LIBCMT ref: 00007FF6E3799C83
_set_statfp.LIBCMT ref: 00007FF6E3799C9F
_set_statfp.LIBCMT ref: 00007FF6E3799CDB

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: d791576840cf3554430a7292a0c69b5a0a6b3b80c51ee703a7db7d58481ad49b
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: 43111C63E18A0301FF541979A94737528D06F5F360E061B34E96EA62DADE2EAC60420E

Function 00007FF6E378B950 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6E378AB67,?,?,00000000,00007FF6E378AE02,?,?,?,?,?,00007FF6E37830CC), ref: 00007FF6E378B96F
FlsSetValue.KERNEL32(?,?,?,00007FF6E378AB67,?,?,00000000,00007FF6E378AE02,?,?,?,?,?,00007FF6E37830CC), ref: 00007FF6E378B98E
FlsSetValue.KERNEL32(?,?,?,00007FF6E378AB67,?,?,00000000,00007FF6E378AE02,?,?,?,?,?,00007FF6E37830CC), ref: 00007FF6E378B9B6
FlsSetValue.KERNEL32(?,?,?,00007FF6E378AB67,?,?,00000000,00007FF6E378AE02,?,?,?,?,?,00007FF6E37830CC), ref: 00007FF6E378B9C7
FlsSetValue.KERNEL32(?,?,?,00007FF6E378AB67,?,?,00000000,00007FF6E378AE02,?,?,?,?,?,00007FF6E37830CC), ref: 00007FF6E378B9D8

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4fc6ccaa14371e387e5c22fb95057e46c3ade10dd54edcd3ce0e48e5b46d1de5
Instruction ID: 2a8c826610641a92734516a44df32bb4524680a8734b1cd0a84fb060526c0025
Opcode Fuzzy Hash: 4fc6ccaa14371e387e5c22fb95057e46c3ade10dd54edcd3ce0e48e5b46d1de5
Instruction Fuzzy Hash: 58116D22B0966281FE589726E9533397D415F843B0F144334E87DE67C6DE2EF462860F

Function 00007FF6E378B7E4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6E378B7F5
FlsSetValue.KERNEL32 ref: 00007FF6E378B814
FlsSetValue.KERNEL32 ref: 00007FF6E378B83C
FlsSetValue.KERNEL32 ref: 00007FF6E378B84D
FlsSetValue.KERNEL32 ref: 00007FF6E378B85E

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 64fe73475c7f3c5e3ff0e30dd8e21900901c314ca9004384e47b330d372873f3
Instruction ID: 89e6b92816658c021937ede99448dab542ba11c8f588ffeb2a1b66faeb059267
Opcode Fuzzy Hash: 64fe73475c7f3c5e3ff0e30dd8e21900901c314ca9004384e47b330d372873f3
Instruction Fuzzy Hash: C4111C12E0922741FE58663198133793D419F85370E140B34D93DE96D3EE2EB421964F

Function 00007FF6E37864B4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E37864F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E378661A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E37866D0

Strings

verbose, xrefs: 00007FF6E37864C4

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction ID: 59354553bebf2fdd16239183612994d98ee0bfda8b129ba2d8182606951fe489
Opcode Fuzzy Hash: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction Fuzzy Hash: D791E023A0C6A691FF618E25E41237D3BA0AB00B54F464136DB5DE73C5DE3EE821834E

Function 00007FF6E37905A8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3790887

Part of subcall function 00007FF6E37969C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E37969E1

Strings

UTF-8, xrefs: 00007FF6E3790806
ccs, xrefs: 00007FF6E37907C2
UTF-16LEUNICODE, xrefs: 00007FF6E3790825

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
Instruction ID: c7972bb5d303296bddd15aff167160c8b650046477580d480d390dedc647dbe2
Opcode Fuzzy Hash: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
Instruction Fuzzy Hash: 3881B377E2860285FE644F2585163783EA0AB10B94F5742B8CA09F7295CF2FE4619A4F

Function 00007FF6E377EFD8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6E377F024
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6E377F073

Strings

RCC, xrefs: 00007FF6E377F041
MOC, xrefs: 00007FF6E377F038

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
Instruction ID: 2859b1deb376b342b7e7fae6e98eb3cf2e10353eeafa18382865d6174ca143e0
Opcode Fuzzy Hash: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
Instruction Fuzzy Hash: CE619C33A08B458AEB10CF65D5813AD7BA0FB48B99F044225EF4D67B94DF39E064C709

Function 00007FF6E377F334 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6E377F35C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6E377F444

Strings

csm, xrefs: 00007FF6E377F37E
csm, xrefs: 00007FF6E377F496

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
Instruction ID: f1bd481ba6098fc96f5d94981d81b5e5af8bab3cefd82c25332a2a2037e73ea9
Opcode Fuzzy Hash: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
Instruction Fuzzy Hash: 16518E3390828286EE648F25D6463787BA0EF45B96F144135DA9CA7BD5CF3DE460CB0E

Function 00007FF6E3772890 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3778AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3772ABB), ref: 00007FF6E3778B1A

MessageBoxW.USER32 ref: 00007FF6E377299B
MessageBoxA.USER32 ref: 00007FF6E37729B7

Strings

Fatal error detected, xrefs: 00007FF6E3772971, 00007FF6E37729A9
%s%s: %s, xrefs: 00007FF6E3772916

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
Instruction ID: 280a376f6cc6d273e55d9d0389d055af8cab976b506049cb0ab536ffa42f70ff
Opcode Fuzzy Hash: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
Instruction Fuzzy Hash: 0031A57362868181EA30DB10E4427EA7BA4FF847C4F804136E68DA7A99CF3DD215CB4D

Function 00007FF6E3773EC0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6E37739EA), ref: 00007FF6E3773EF1

Part of subcall function 00007FF6E37729E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6E37787F2,?,?,?,?,?,?,?,?,?,?,?,00007FF6E377101D), ref: 00007FF6E3772A14
Part of subcall function 00007FF6E37729E0: MessageBoxW.USER32 ref: 00007FF6E3772AF0

Strings

GetModuleFileNameW, xrefs: 00007FF6E3773F02
Failed to convert executable path to UTF-8., xrefs: 00007FF6E3773F2A
Failed to get executable path., xrefs: 00007FF6E3773EFB

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
Instruction ID: 210569a11787fde20893db2b597df1999bffeffc6f9dc61f8ae429fed1ea30c1
Opcode Fuzzy Hash: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
Instruction Fuzzy Hash: 0B017123B2D64790FE609B24E8573B53A91EF487C5F810431D84DE66D2EE1EE135870E

Function 00007FF6E378CB60 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6E378CBDF
WriteFile.KERNEL32 ref: 00007FF6E378CEA7
WriteFile.KERNEL32 ref: 00007FF6E378CEED
GetLastError.KERNEL32 ref: 00007FF6E378CFA3

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
Instruction ID: 9b2593b7bb597ef90efe1c37140f27b0591c1ec1b133d184d72209056f503c26
Opcode Fuzzy Hash: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
Instruction Fuzzy Hash: 53D1F073B18A92C9EB10CF75D4412ACBBB1FB44B98B044235DE5DA7B99DE39D426C308

Function 00007FF6E3772330 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6E3772364
SetWindowLongPtrW.USER32 ref: 00007FF6E3772386
GetWindowLongPtrW.USER32 ref: 00007FF6E37723B0
InvalidateRect.USER32 ref: 00007FF6E37723D0

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
Instruction ID: a5d34260ee6a0a493b835b07e5530f9689933296da4e005f98528394cb1f3a02
Opcode Fuzzy Hash: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
Instruction Fuzzy Hash: 7C11E922E0814282FE549B69F5463793A91EF8CB81F458130EA6956BCECDAED4E1460D

Function 00007FF6E379628C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3791DD0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E3791E03

_get_daylight.LIBCMT ref: 00007FF6E37963A4
_get_daylight.LIBCMT ref: 00007FF6E37963B5

Strings

?, xrefs: 00007FF6E3796335

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
Instruction ID: edc035a99903b9a32799a358b20c06d586dc81dc709c77ba7ed839a20711fa9a
Opcode Fuzzy Hash: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
Instruction Fuzzy Hash: DA41E313A1C29242FF209B25944237A7EA0EB847B4F164335EE5C96AD5DE3ED461C70D

Function 00007FF6E37895A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E37895D6

Part of subcall function 00007FF6E378AF0C: RtlFreeHeap.NTDLL(?,?,?,00007FF6E3793392,?,?,?,00007FF6E37933CF,?,?,00000000,00007FF6E3793895,?,?,00000000,00007FF6E37937C7), ref: 00007FF6E378AF22
Part of subcall function 00007FF6E378AF0C: GetLastError.KERNEL32(?,?,?,00007FF6E3793392,?,?,?,00007FF6E37933CF,?,?,00000000,00007FF6E3793895,?,?,00000000,00007FF6E37937C7), ref: 00007FF6E378AF2C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6E377BFE5), ref: 00007FF6E37895F4

Strings

C:\Users\user\Desktop\3OQL58yflv.exe, xrefs: 00007FF6E37895E2

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\3OQL58yflv.exe
API String ID: 3580290477-3060527791
Opcode ID: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
Instruction ID: 7b82d513b691988703fd55a8ba3b1088834f2af112fbc44fc14bf722ad58b60d
Opcode Fuzzy Hash: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
Instruction Fuzzy Hash: 2D419333A08B2286EF54DF2194423BC3BA5EF85794B544035EA4E97B85DF3EE861830D

Function 00007FF6E378D1F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6E378D30F
GetLastError.KERNEL32 ref: 00007FF6E378D331

Strings

U, xrefs: 00007FF6E378D2BB

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
Instruction ID: ec0995c4f24d4dead67843bca0e003b06a3088a24a9e178630f96dee7a3b119e
Opcode Fuzzy Hash: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
Instruction Fuzzy Hash: B941D023A18B9182EB20CF25E4453AA7BA0FB88794F804131EE4DD7B98EF3DD451C709

Function 00007FF6E378F918 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6E378F958
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6E378F9AA

Strings

:, xrefs: 00007FF6E378F96E

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 4482f0b2aa88d097fa4b172b4d0b9d8fa621ceaf6a6e580bcf5a02da10cef38f
Instruction ID: 139f77f5f2b789dbef594e066d26cd31507fcd02bb3e5ca939585f8e224b03d1
Opcode Fuzzy Hash: 4482f0b2aa88d097fa4b172b4d0b9d8fa621ceaf6a6e580bcf5a02da10cef38f
Instruction Fuzzy Hash: B6210423A0829581EF209B15E00636E77B1FF88B44F518036DA8DD3284DF7EE966C74E

Function 00007FF6E3772C50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3778AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3772ABB), ref: 00007FF6E3778B1A

MessageBoxW.USER32 ref: 00007FF6E3772D25
MessageBoxA.USER32 ref: 00007FF6E3772D41

Strings

Error detected, xrefs: 00007FF6E3772CFB, 00007FF6E3772D33

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
Instruction ID: 1f7d251de14d8ab1183e100dec92718c1137510590ee2d4e00d701674c8d0fd3
Opcode Fuzzy Hash: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
Instruction Fuzzy Hash: BC21D67362868691EB20DB10F4927EA7B94FF88784F805135D64DA7AA8DF3DD214C70D

Function 00007FF6E3772B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E3778AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6E3772ABB), ref: 00007FF6E3778B1A

MessageBoxW.USER32 ref: 00007FF6E3772C05
MessageBoxA.USER32 ref: 00007FF6E3772C21

Strings

Fatal error detected, xrefs: 00007FF6E3772BDB, 00007FF6E3772C13

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
Instruction ID: 7e465e9d74702641955521afff8f6a1f380a54a43a3a108d7edb1b86a4dbc3f7
Opcode Fuzzy Hash: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
Instruction Fuzzy Hash: DF21B47362868191EB20DB10E4527EA7B94FF887C4F805135D64DA7AA4DF3DD214CB09

Function 00007FF6E377FE80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6E377FED0
RaiseException.KERNEL32 ref: 00007FF6E377FF11

Strings

csm, xrefs: 00007FF6E377FEFE

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
Instruction ID: eb2089e833b865af7ae4f3cea2efa4136bdb67da050c9443611301fe9b83ec8e
Opcode Fuzzy Hash: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
Instruction Fuzzy Hash: E8113733618B4182EB608F15F5403697BA0FB88B84F584234DA8C977A9DF3DC561CB08

Function 00007FF6E379041C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E379044C
GetDriveTypeW.KERNEL32 ref: 00007FF6E379048C

Strings

:, xrefs: 00007FF6E3790475

Memory Dump Source

Source File: 00000000.00000002.2933062987.00007FF6E3771000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E3770000, based on PE: true

Associated: 00000000.00000002.2933041440.00007FF6E3770000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933094603.00007FF6E379B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933116965.00007FF6E37B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2933155107.00007FF6E37B2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e3770000_3OQL58yflv.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
Instruction ID: dcc4b8099630fec125624c577141595dec8acf1dde6d09d1957044e8eeeabe6b
Opcode Fuzzy Hash: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
Instruction Fuzzy Hash: AB01DF2392820286FF20AF20942337E3BA0EF84715F810135D94CD66A1DE3EE524CA1E

Analysis Process: 3OQL58yflv.exePID: 6520, Parent PID: 6300COMMON

Executed Functions

Function 00007FFE11511220 Relevance: 673.2, APIs: 191, Strings: 193, Instructions: 1225networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FFE11511258
Py_AtExit.PYTHON312 ref: 00007FFE1151126D
PyErr_NewException.PYTHON312 ref: 00007FFE11511293
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE115112B3
PyErr_NewException.PYTHON312 ref: 00007FFE115112D5
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE115112F5
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE11511317
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE11511339
PyType_FromMetaclass.PYTHON312 ref: 00007FFE11511356
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE11511375
PyModule_AddType.PYTHON312 ref: 00007FFE11511389
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE115113A8

Part of subcall function 00007FFE11511150: PyMem_Malloc.PYTHON312 ref: 00007FFE1151115E

PyCapsule_New.PYTHON312 ref: 00007FFE115113DB
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE115113FA
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511426
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511444
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511462
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511480
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151149E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115114BC
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115114DA
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115114F8
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511516
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511534
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511552
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511570
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151158E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115115AC
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115115CA
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE115115E9
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE11511608
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE11511627
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE11511646
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE11511665
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE11511684
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115116A2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115116C0
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE115116DF
PyModule_AddStringConstant.PYTHON312 ref: 00007FFE115116FE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151171C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151173A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511758
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511776
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511794
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115117B2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115117D0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115117EE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151180C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151182A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511848
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511866
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511884
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115118A2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115118C0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115118DE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115118FC
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151191A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511938
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511956
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511974
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511992
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115119B0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115119CE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115119EC
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511A0A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511A28
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511A46
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511A64
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511A82
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511AA0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511ABE
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511ADC
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511AFA
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511B18
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511B36
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511B54
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511B6F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511B8A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511BA8
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511BC6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511BE4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511C02
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511C20
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511C3E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511C5C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511C7A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511C98
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511CB6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511CD4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511CF2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511D10
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511D2E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511D4C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511D6A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511D88
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511DA6
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511DC4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511DE2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511E00
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511E1E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511E3C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511E5A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511E78
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511E96
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511EB4
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511ED2
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511EF0
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511F0E
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511F2C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511F4A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511F65
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511F83
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511FA1
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511FBF
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511FDD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11511FFB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512019
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512037
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512055
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512073
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512091
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115120AF
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115120CD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115120EB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512109
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512127
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512145
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512163
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512181
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151219F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115121BD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115121DB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115121F9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512217
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512235
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512253
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512271
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151228F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115122AD
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115122CB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115122E9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512307
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512325
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512343
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512361
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151237F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151239D
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115123BB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115123D9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115123F7
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512415
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512433
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512451
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151246F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151248D
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115124AB
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115124C9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115124E7
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512505
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512523
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512541
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151255F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151257D
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151259B
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115125B9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115125D7
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115125F5
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512613
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512631
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151264F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151266D
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151268B
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115126A9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115126C7
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115126E5
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512703
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512721
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151273F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151275A
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512778
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512796
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE1151280B
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE11512826
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512861
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE1151287F
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11512899
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE115128B3
PyErr_Format.PYTHON312 ref: 00007FFE115139BE
_Py_Dealloc.PYTHON312 ref: 00007FFE11513A01
_Py_Dealloc.PYTHON312 ref: 00007FFE11513A10

Strings

IPV6_MULTICAST_HOPS, xrefs: 00007FFE11512249
HV_GUID_LOOPBACK, xrefs: 00007FFE1151165E
gaierror, xrefs: 00007FFE115112EB
MSG_PEEK, xrefs: 00007FFE11511A00
WSAStartup failed: error code %d, xrefs: 00007FFE115139B1
IPPROTO_GGP, xrefs: 00007FFE11511BDA
TCP_FASTOPEN, xrefs: 00007FFE11512483
SHUT_WR, xrefs: 00007FFE1151276E
SO_ERROR, xrefs: 00007FFE11511988
AI_CANONNAME, xrefs: 00007FFE115125CD
IPPROTO_ICLFXBM, xrefs: 00007FFE11511E32
SO_USELOOPBACK, xrefs: 00007FFE1151187A
SO_KEEPALIVE, xrefs: 00007FFE11511820
NI_MAXHOST, xrefs: 00007FFE11512681
EAI_MEMORY, xrefs: 00007FFE11512519
SO_DONTROUTE, xrefs: 00007FFE1151183E
IPPROTO_L2TP, xrefs: 00007FFE11511EE6
IPPROTO_ST, xrefs: 00007FFE11511E50
IPV6_LEAVE_GROUP, xrefs: 00007FFE1151222B
SOMAXCONN, xrefs: 00007FFE115119C4
IPPROTO_IGMP, xrefs: 00007FFE11511BBC
IPPROTO_RDP, xrefs: 00007FFE11511EAA
socket.herror, xrefs: 00007FFE11511277
has_ipv6, xrefs: 00007FFE1151139E
IPPROTO_TCP, xrefs: 00007FFE11511C34
NI_NUMERICSERV, xrefs: 00007FFE11512717
AF_INET, xrefs: 00007FFE1151143A
IP_HDRINCL, xrefs: 00007FFE1151204B
RCVALL_OFF, xrefs: 00007FFE11512857
TCP_KEEPCNT, xrefs: 00007FFE11512465
AI_ALL, xrefs: 00007FFE11512627
SOCK_RAW, xrefs: 00007FFE1151174E
EAI_SOCKTYPE, xrefs: 00007FFE11512591
CAPI, xrefs: 00007FFE115113F0
SO_DEBUG, xrefs: 00007FFE115117A8
IPPROTO_ESP, xrefs: 00007FFE11511D24
IPPROTO_HOPOPTS, xrefs: 00007FFE11511B80
00000000-0000-0000-0000-000000000000, xrefs: 00007FFE115115D8, 00007FFE115115F7
IPPROTO_IP, xrefs: 00007FFE11511B65
MSG_WAITALL, xrefs: 00007FFE11511A78
EAI_NODATA, xrefs: 00007FFE11512537
IPV6_PKTINFO, xrefs: 00007FFE11512357
socket.gaierror, xrefs: 00007FFE115112C8
IPV6_DONTFRAG, xrefs: 00007FFE115122FD
SO_RCVBUF, xrefs: 00007FFE115118F2
SOCK_DGRAM, xrefs: 00007FFE11511730
RCVALL_SOCKETLEVELONLY, xrefs: 00007FFE1151288F
HV_GUID_PARENT, xrefs: 00007FFE1151167D
IP_ADD_MEMBERSHIP, xrefs: 00007FFE1151213B
SOL_UDP, xrefs: 00007FFE11511B4A
AI_NUMERICHOST, xrefs: 00007FFE115125EB
IPPROTO_RAW, xrefs: 00007FFE11511DF6
BDADDR_ANY, xrefs: 00007FFE115116D8
MSG_DONTROUTE, xrefs: 00007FFE11511A1E
HVSOCKET_ADDRESS_FLAG_PASSTHRU, xrefs: 00007FFE115115C0
SOL_SOCKET, xrefs: 00007FFE11511AF0
IP_ADD_SOURCE_MEMBERSHIP, xrefs: 00007FFE115121D1
IPPROTO_DSTOPTS, xrefs: 00007FFE11511D9C
TCP_NODELAY, xrefs: 00007FFE115123ED
IP_DROP_MEMBERSHIP, xrefs: 00007FFE11512159
IPPROTO_IPV4, xrefs: 00007FFE11511BF8
IP_RECVTOS, xrefs: 00007FFE115120A5
AF_LINK, xrefs: 00007FFE115114D0
AF_BLUETOOTH, xrefs: 00007FFE11511698
INADDR_BROADCAST, xrefs: 00007FFE11511F79
AF_SNA, xrefs: 00007FFE115114EE
MSG_CTRUNC, xrefs: 00007FFE11511A5A
IPV6_RTHDR, xrefs: 00007FFE115123B1
BDADDR_LOCAL, xrefs: 00007FFE115116F7
SOCK_SEQPACKET, xrefs: 00007FFE1151176C
IP_TTL, xrefs: 00007FFE11512087
NI_NUMERICHOST, xrefs: 00007FFE115126DB
IPPORT_RESERVED, xrefs: 00007FFE11511F22
IPPROTO_ROUTING, xrefs: 00007FFE11511CE8
IP_PKTINFO, xrefs: 00007FFE11512177
SO_OOBINLINE, xrefs: 00007FFE115118B6
HVSOCKET_CONNECT_TIMEOUT_MAX, xrefs: 00007FFE11511584
AF_UNSPEC, xrefs: 00007FFE1151141C
SO_SNDTIMEO, xrefs: 00007FFE1151194C
TCP_MAXSEG, xrefs: 00007FFE1151240B
SO_BROADCAST, xrefs: 00007FFE1151185C
A42E7CDA-D03F-480C-9CC2-A4DE20ABB878, xrefs: 00007FFE11511673
IP_OPTIONS, xrefs: 00007FFE1151202D
EAI_FAIL, xrefs: 00007FFE115124DD
IPPROTO_PIM, xrefs: 00007FFE11511DBA
SO_REUSEADDR, xrefs: 00007FFE115117E4
NI_NOFQDN, xrefs: 00007FFE115126BD
SO_LINGER, xrefs: 00007FFE11511898
SOCK_RDM, xrefs: 00007FFE1151178A
00:00:00:FF:FF:FF, xrefs: 00007FFE115116ED
IP_DROP_SOURCE_MEMBERSHIP, xrefs: 00007FFE115121EF
IPV6_MULTICAST_IF, xrefs: 00007FFE11512267
IPPROTO_MAX, xrefs: 00007FFE11511E14
IPV6_UNICAST_HOPS, xrefs: 00007FFE115122A3
SO_SNDLOWAT, xrefs: 00007FFE11511910
EAI_NONAME, xrefs: 00007FFE11512555
IPPROTO_AH, xrefs: 00007FFE11511D42
IPV6_HOPLIMIT, xrefs: 00007FFE1151231B
SIO_LOOPBACK_FAST_PATH, xrefs: 00007FFE115127E8
IPV6_RECVRTHDR, xrefs: 00007FFE11512375
IPPROTO_PUP, xrefs: 00007FFE11511C70
SO_ACCEPTCONN, xrefs: 00007FFE115117C6
MSG_MCAST, xrefs: 00007FFE11511AD2
WSAStartup failed: network not ready, xrefs: 00007FFE115139CA
IPV6_HOPOPTS, xrefs: 00007FFE11512339
90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD, xrefs: 00007FFE11511635
HVSOCKET_CONNECTED_SUSPEND, xrefs: 00007FFE115115A2
SIO_KEEPALIVE_VALS, xrefs: 00007FFE115127C6
SO_EXCLUSIVEADDRUSE, xrefs: 00007FFE11511802
HV_GUID_BROADCAST, xrefs: 00007FFE11511620
MSG_BCAST, xrefs: 00007FFE11511AB4
EAI_AGAIN, xrefs: 00007FFE115124A1
SOL_IP, xrefs: 00007FFE11511B0E
IPPROTO_UDP, xrefs: 00007FFE11511C8E
timeout, xrefs: 00007FFE1151132C
NI_NAMEREQD, xrefs: 00007FFE115126F9
E0E16197-DD56-4A10-9195-5EE7A155A838, xrefs: 00007FFE11511654
EAI_FAMILY, xrefs: 00007FFE115124FB
AF_APPLETALK, xrefs: 00007FFE11511476
TCP_KEEPINTVL, xrefs: 00007FFE11512447
IPPROTO_ICMPV6, xrefs: 00007FFE11511D60
IPV6_RECVTCLASS, xrefs: 00007FFE11512393
IP_TOS, xrefs: 00007FFE11512069
_socket.CAPI, xrefs: 00007FFE115113D4
AI_V4MAPPED, xrefs: 00007FFE11512663
IP_BLOCK_SOURCE, xrefs: 00007FFE115121B3
HV_GUID_CHILDREN, xrefs: 00007FFE1151163F
SOL_TCP, xrefs: 00007FFE11511B2C
HVSOCKET_CONNECT_TIMEOUT, xrefs: 00007FFE11511566
FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF, xrefs: 00007FFE11511616
MSG_OOB, xrefs: 00007FFE115119E2
SHUT_RDWR, xrefs: 00007FFE1151278C
IP_MULTICAST_LOOP, xrefs: 00007FFE1151211D
error, xrefs: 00007FFE1151130A
SOCK_STREAM, xrefs: 00007FFE11511712
NI_MAXSERV, xrefs: 00007FFE1151269F
IPV6_CHECKSUM, xrefs: 00007FFE115122DF
IPV6_V6ONLY, xrefs: 00007FFE115122C1
WSAStartup failed: requested version not supported, xrefs: 00007FFE115139D3
INADDR_NONE, xrefs: 00007FFE1151200F
IPPROTO_IDP, xrefs: 00007FFE11511CAC
IPPROTO_IPV6, xrefs: 00007FFE11511C16
MSG_ERRQUEUE, xrefs: 00007FFE11511A96
IP_RECVDSTADDR, xrefs: 00007FFE115120C3
AI_NUMERICSERV, xrefs: 00007FFE11512609
AI_ADDRCONFIG, xrefs: 00007FFE11512645
HV_GUID_WILDCARD, xrefs: 00007FFE11511601
INADDR_MAX_LOCAL_GROUP, xrefs: 00007FFE11511FF1
BTPROTO_RFCOMM, xrefs: 00007FFE115116B6
IPPROTO_NONE, xrefs: 00007FFE11511D7E
IP_MULTICAST_IF, xrefs: 00007FFE115120E1
00:00:00:00:00:00, xrefs: 00007FFE115116CE
AF_DECnet, xrefs: 00007FFE115114B2
EAI_SERVICE, xrefs: 00007FFE11512573
SocketType, xrefs: 00007FFE1151136B
IPV6_TCLASS, xrefs: 00007FFE115123CF
AF_IPX, xrefs: 00007FFE11511458
IPPROTO_PGM, xrefs: 00007FFE11511EC8
herror, xrefs: 00007FFE115112A9
AI_PASSIVE, xrefs: 00007FFE115125AF
IPPORT_USERRESERVED, xrefs: 00007FFE11511F40
IPPROTO_ND, xrefs: 00007FFE11511CCA
IP_UNBLOCK_SOURCE, xrefs: 00007FFE11512195
EAI_BADFLAGS, xrefs: 00007FFE115124BF
AF_IRDA, xrefs: 00007FFE1151150C
HV_PROTOCOL_RAW, xrefs: 00007FFE11511548
IP_MULTICAST_TTL, xrefs: 00007FFE115120FF
INADDR_ALLHOSTS_GROUP, xrefs: 00007FFE11511FD3
IPPROTO_FRAGMENT, xrefs: 00007FFE11511D06
INADDR_ANY, xrefs: 00007FFE11511F5B
INADDR_LOOPBACK, xrefs: 00007FFE11511F97
SHUT_RD, xrefs: 00007FFE11512750
MSG_TRUNC, xrefs: 00007FFE11511A3C
HV_GUID_ZERO, xrefs: 00007FFE115115E2
IPPROTO_CBT, xrefs: 00007FFE11511E6E
NI_DGRAM, xrefs: 00007FFE11512735
SO_SNDBUF, xrefs: 00007FFE115118D4
RCVALL_MAX, xrefs: 00007FFE115128A9
AF_HYPERV, xrefs: 00007FFE1151152A
IPV6_MULTICAST_LOOP, xrefs: 00007FFE11512285
IPPROTO_SCTP, xrefs: 00007FFE11511DD8, 00007FFE11511F04
RCVALL_ON, xrefs: 00007FFE11512875
IPPROTO_ICMP, xrefs: 00007FFE11511B9E
SO_RCVLOWAT, xrefs: 00007FFE1151192E
AF_INET6, xrefs: 00007FFE11511494
IPPROTO_EGP, xrefs: 00007FFE11511C52
SIO_RCVALL, xrefs: 00007FFE115127A4
IPPROTO_IGP, xrefs: 00007FFE11511E8C
IPV6_JOIN_GROUP, xrefs: 00007FFE1151220D
SO_RCVTIMEO, xrefs: 00007FFE1151196A
TCP_KEEPIDLE, xrefs: 00007FFE11512429
INADDR_UNSPEC_GROUP, xrefs: 00007FFE11511FB5
SO_TYPE, xrefs: 00007FFE115119A6

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Module_$Constant$ObjectString$Err_$DeallocExceptionFrom$Capsule_ExitFormatLongLong_MallocMem_MetaclassStartupTypeType_Unsigned
String ID: 00000000-0000-0000-0000-000000000000$00:00:00:00:00:00$00:00:00:FF:FF:FF$90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD$A42E7CDA-D03F-480C-9CC2-A4DE20ABB878$AF_APPLETALK$AF_BLUETOOTH$AF_DECnet$AF_HYPERV$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_LINK$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$BDADDR_ANY$BDADDR_LOCAL$BTPROTO_RFCOMM$CAPI$E0E16197-DD56-4A10-9195-5EE7A155A838$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF$HVSOCKET_ADDRESS_FLAG_PASSTHRU$HVSOCKET_CONNECTED_SUSPEND$HVSOCKET_CONNECT_TIMEOUT$HVSOCKET_CONNECT_TIMEOUT_MAX$HV_GUID_BROADCAST$HV_GUID_CHILDREN$HV_GUID_LOOPBACK$HV_GUID_PARENT$HV_GUID_WILDCARD$HV_GUID_ZERO$HV_PROTOCOL_RAW$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_ADD_SOURCE_MEMBERSHIP$IP_BLOCK_SOURCE$IP_DROP_MEMBERSHIP$IP_DROP_SOURCE_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_PKTINFO$IP_RECVDSTADDR$IP_RECVTOS$IP_TOS$IP_TTL$IP_UNBLOCK_SOURCE$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$WSAStartup failed: error code %d$WSAStartup failed: network not ready$WSAStartup failed: requested version not supported$_socket.CAPI$error$gaierror$has_ipv6$herror$socket.gaierror$socket.herror$timeout
API String ID: 585143114-1188461360
Opcode ID: 7ce75d0e8ce51beaa5017a69f1cafd12c0347cf952baad51f27e7ce9e03ee791
Instruction ID: 9bc84ae681e75e2c93bac528aea07e7b9471882f4f4f3be1ca1ec70f73c70561
Opcode Fuzzy Hash: 7ce75d0e8ce51beaa5017a69f1cafd12c0347cf952baad51f27e7ce9e03ee791
Instruction Fuzzy Hash: 3AC2C3A8F18F5391FB069B27E85426527AABF45BE0F8450B5CD0E86675FF6DE209C300

Function 00007FFE103018C0 Relevance: 142.0, APIs: 44, Strings: 37, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyModule_Create2.PYTHON3 ref: 00007FFE103018EB
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FFE10301904

Part of subcall function 00007FFE103013D0: PyEval_SaveThread.PYTHON3 ref: 00007FFE103013DA
Part of subcall function 00007FFE103013D0: LoadLibraryA.KERNEL32 ref: 00007FFE103013EA
Part of subcall function 00007FFE103013D0: PyEval_RestoreThread.PYTHON3 ref: 00007FFE103013F6
Part of subcall function 00007FFE103013D0: PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFE1030140A

RtlGetVersion.NTDLL ref: 00007FFE10301945
GetSystemInfo.KERNEL32 ref: 00007FFE103019C1
InitializeCriticalSection.KERNEL32 ref: 00007FFE103019CE
PyModule_GetState.PYTHON3 ref: 00007FFE103019E8
PyErr_NewException.PYTHON3 ref: 00007FFE103019FD
_Py_Dealloc.PYTHON3 ref: 00007FFE10301A1B
PyErr_NewException.PYTHON3 ref: 00007FFE10301A50
PyModule_AddObject.PYTHON3 ref: 00007FFE10301A6D
PyErr_NewException.PYTHON3 ref: 00007FFE10301A7F
PyModule_AddObject.PYTHON3 ref: 00007FFE10301A9C
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301AB2
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301AC8
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301ADE
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301AF4
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301B0A
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301B20
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301B36
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301B49
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301B5F
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301B75
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301B8B
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301BA1
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301BB7
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301BCD
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301BE3
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301BF9
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301C0F
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301C25
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301C3B
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301C51
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301C67
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301C7D
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301C93
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301CA9
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301CBF
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301CD5
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301CEC
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301D02
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301D18
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301D2E
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301D44
PyModule_AddIntConstant.PYTHON3 ref: 00007FFE10301D5A

Strings

WINDOWS_7, xrefs: 00007FFE10301D0E
MIB_TCP_STATE_FIN_WAIT2, xrefs: 00007FFE10301BEF
MIB_TCP_STATE_CLOSE_WAIT, xrefs: 00007FFE10301B6B
REALTIME_PRIORITY_CLASS, xrefs: 00007FFE10301B2C
NORMAL_PRIORITY_CLASS, xrefs: 00007FFE10301B16
version, xrefs: 00007FFE10301AA8
HIGH_PRIORITY_CLASS, xrefs: 00007FFE10301AEA
MIB_TCP_STATE_SYN_RCVD, xrefs: 00007FFE10301BC3
MIB_TCP_STATE_LISTEN, xrefs: 00007FFE10301B81
MIB_TCP_STATE_DELETE_TCB, xrefs: 00007FFE10301C47
MIB_TCP_STATE_LAST_ACK, xrefs: 00007FFE10301C05
WINDOWS_VISTA, xrefs: 00007FFE10301CF8
MIB_TCP_STATE_CLOSED, xrefs: 00007FFE10301B3F
_psutil_windows.TimeoutExpired, xrefs: 00007FFE10301A47
INFINITE, xrefs: 00007FFE10301C73
TimeoutAbandoned, xrefs: 00007FFE10301A85
BELOW_NORMAL_PRIORITY_CLASS, xrefs: 00007FFE10301AD4
MIB_TCP_STATE_CLOSING, xrefs: 00007FFE10301B55
MIB_TCP_STATE_SYN_SENT, xrefs: 00007FFE10301BAD
TimeoutExpired, xrefs: 00007FFE10301A56
ERROR_ACCESS_DENIED, xrefs: 00007FFE10301C89
WINDOWS_8_1, xrefs: 00007FFE10301D3A
IDLE_PRIORITY_CLASS, xrefs: 00007FFE10301B00
WINDOWS_10, xrefs: 00007FFE10301D50
ERROR_INVALID_NAME, xrefs: 00007FFE10301C9F
MIB_TCP_STATE_TIME_WAIT, xrefs: 00007FFE10301C1B, 00007FFE10301C31
MIB_TCP_STATE_FIN_WAIT1, xrefs: 00007FFE10301BD9
WINVER, xrefs: 00007FFE10301CE2
ABOVE_NORMAL_PRIORITY_CLASS, xrefs: 00007FFE10301ABE
_psutil_windows.Error, xrefs: 00007FFE103019F1
_psutil_windows.TimeoutAbandoned, xrefs: 00007FFE10301A76
PSUTIL_CONN_NONE, xrefs: 00007FFE10301C5D
PSUTIL_DEBUG, xrefs: 00007FFE103018FD
ERROR_SERVICE_DOES_NOT_EXIST, xrefs: 00007FFE10301CB5
MIB_TCP_STATE_ESTAB, xrefs: 00007FFE10301B97
ERROR_PRIVILEGE_NOT_HELD, xrefs: 00007FFE10301CCB
WINDOWS_8, xrefs: 00007FFE10301D24

Memory Dump Source

Source File: 00000001.00000002.2937676674.00007FFE10301000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE10300000, based on PE: true

Associated: 00000001.00000002.2937662597.00007FFE10300000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937692179.00007FFE1030B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937707021.00007FFE10310000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937729384.00007FFE10311000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10300000_3OQL58yflv.jbxd

Similarity

API ID: Module_$Constant$Err_$Exception$Eval_ObjectThread$Create2CriticalDeallocFilenameFromInfoInitializeLibraryLoadRestoreSaveSectionStateSystemVersionWindowsWithgetenv
String ID: ABOVE_NORMAL_PRIORITY_CLASS$BELOW_NORMAL_PRIORITY_CLASS$ERROR_ACCESS_DENIED$ERROR_INVALID_NAME$ERROR_PRIVILEGE_NOT_HELD$ERROR_SERVICE_DOES_NOT_EXIST$HIGH_PRIORITY_CLASS$IDLE_PRIORITY_CLASS$INFINITE$MIB_TCP_STATE_CLOSED$MIB_TCP_STATE_CLOSE_WAIT$MIB_TCP_STATE_CLOSING$MIB_TCP_STATE_DELETE_TCB$MIB_TCP_STATE_ESTAB$MIB_TCP_STATE_FIN_WAIT1$MIB_TCP_STATE_FIN_WAIT2$MIB_TCP_STATE_LAST_ACK$MIB_TCP_STATE_LISTEN$MIB_TCP_STATE_SYN_RCVD$MIB_TCP_STATE_SYN_SENT$MIB_TCP_STATE_TIME_WAIT$NORMAL_PRIORITY_CLASS$PSUTIL_CONN_NONE$PSUTIL_DEBUG$REALTIME_PRIORITY_CLASS$TimeoutAbandoned$TimeoutExpired$WINDOWS_10$WINDOWS_7$WINDOWS_8$WINDOWS_8_1$WINDOWS_VISTA$WINVER$_psutil_windows.Error$_psutil_windows.TimeoutAbandoned$_psutil_windows.TimeoutExpired$version
API String ID: 887074641-2468274236
Opcode ID: 1f93bd4bca05029bf53ecd07cde9b0c4047c2b8100b84f1851f88f965fc14036
Instruction ID: 6f5bce7def81deab2508cb90ef4623b1294b245561b02922c92ad6196cdd4f90
Opcode Fuzzy Hash: 1f93bd4bca05029bf53ecd07cde9b0c4047c2b8100b84f1851f88f965fc14036
Instruction Fuzzy Hash: 86C10824B1AE0281EA589F13E99477D2366AF49BF0F8040B5CB0E477B9DF6DA349C741

Function 00007FFE10301E90 Relevance: 43.9, APIs: 19, Strings: 6, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyList_New.PYTHON3 ref: 00007FFE10301EA0
PyErr_SetFromWindowsErr.PYTHON3 ref: 00007FFE10301EF3
_Py_Dealloc.PYTHON3 ref: 00007FFE10301F03
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE10301F11

Strings

NtQuerySystemInformation(SystemProcessorPerformanceInformation), xrefs: 00007FFE1030200D
psutil-debug [%s:%d]> , xrefs: 00007FFE10301F61
GetSystemInfo() failed to retrieve CPU count, xrefs: 00007FFE10301FB4
(ddddd), xrefs: 00007FFE10302042
psutil/arch/windows\cpu.c, xrefs: 00007FFE10301F57
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 00007FFE10301F7B

Memory Dump Source

Source File: 00000001.00000002.2937676674.00007FFE10301000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE10300000, based on PE: true

Associated: 00000001.00000002.2937662597.00007FFE10300000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937692179.00007FFE1030B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937707021.00007FFE10310000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937729384.00007FFE10311000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10300000_3OQL58yflv.jbxd

Similarity

API ID: DeallocErr_FromList_Windowsfree
String ID: (ddddd)$GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$NtQuerySystemInformation(SystemProcessorPerformanceInformation)$psutil-debug [%s:%d]> $psutil/arch/windows\cpu.c
API String ID: 2064544276-4027580629
Opcode ID: 7190dbfe5ddc8fd9770f88d7c9040de05d44c9cbbe8f5b86af6aa6a4fad55d9a
Instruction ID: 143a4aec8515237595868d46b0f7957792db4e7ff353a812996b096206c43f7b
Opcode Fuzzy Hash: 7190dbfe5ddc8fd9770f88d7c9040de05d44c9cbbe8f5b86af6aa6a4fad55d9a
Instruction Fuzzy Hash: 6371D731A1AF028AE6569F37E45023DA3A5AF59BA4B044375EF0F62778EF3CE5458700

Function 00007FFE10307DB0 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FFE10307DE7
OpenProcessToken.ADVAPI32 ref: 00007FFE10307DFB
GetLastError.KERNEL32 ref: 00007FFE10307E09
ImpersonateSelf.ADVAPI32 ref: 00007FFE10307E19
OpenProcessToken.ADVAPI32 ref: 00007FFE10307E46

Part of subcall function 00007FFE10301070: GetLastError.KERNEL32 ref: 00007FFE10301092
Part of subcall function 00007FFE10301070: PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFE103010B5

Part of subcall function 00007FFE10307D10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE10307D22
Part of subcall function 00007FFE10307D10: fprintf.MSPDB140-MSVCRT ref: 00007FFE10307D3F
Part of subcall function 00007FFE10307D10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE10307D49
Part of subcall function 00007FFE10307D10: fprintf.MSPDB140-MSVCRT ref: 00007FFE10307D59
Part of subcall function 00007FFE10307D10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE10307D63
Part of subcall function 00007FFE10307D10: fprintf.MSPDB140-MSVCRT ref: 00007FFE10307D73
Part of subcall function 00007FFE10307D10: GetLastError.KERNEL32 ref: 00007FFE10307D78
Part of subcall function 00007FFE10307D10: PyErr_WarnEx.PYTHON3 ref: 00007FFE10307D9A

GetLastError.KERNEL32 ref: 00007FFE10307E66
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFE10307E8D

Strings

AdjustTokenPrivileges, xrefs: 00007FFE10307F4D, 00007FFE10307FB4
ImpersonateSelf, xrefs: 00007FFE10307E23
(originated from %s), xrefs: 00007FFE10307E75, 00007FFE10307EE0, 00007FFE10307F56
OpenProcessToken, xrefs: 00007FFE10307E50, 00007FFE10307E6C
SeDebugPrivilege, xrefs: 00007FFE10307EBE
LookupPrivilegeValue, xrefs: 00007FFE10307ED7

Memory Dump Source

Source File: 00000001.00000002.2937676674.00007FFE10301000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE10300000, based on PE: true

Associated: 00000001.00000002.2937662597.00007FFE10300000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937692179.00007FFE1030B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937707021.00007FFE10310000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937729384.00007FFE10311000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10300000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$Err_Process__acrt_iob_funcfprintf$FilenameFromOpenTokenWindowsWith$CurrentImpersonateSelfWarn
String ID: (originated from %s)$AdjustTokenPrivileges$ImpersonateSelf$LookupPrivilegeValue$OpenProcessToken$SeDebugPrivilege
API String ID: 2544101647-3705996988
Opcode ID: 34da3196203b84411ab0fd01f7fc5e768038530ca3460100517b82b84452998e
Instruction ID: db1fbed463d448e3f8aa229c68bc08584a1c35f07953fd7ae398bec3e2049572
Opcode Fuzzy Hash: 34da3196203b84411ab0fd01f7fc5e768038530ca3460100517b82b84452998e
Instruction Fuzzy Hash: DB512C22A1EE8682E7549F26E8442AE6364FB447A4F5044B6E78E0277DDF3CE649C740

Function 00007FFE103013D0 Relevance: 89.5, APIs: 27, Strings: 24, Instructions: 229
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyEval_SaveThread.PYTHON3 ref: 00007FFE103013DA
LoadLibraryA.KERNEL32 ref: 00007FFE103013EA
PyEval_RestoreThread.PYTHON3 ref: 00007FFE103013F6
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFE1030140A
GetProcAddress.KERNEL32 ref: 00007FFE1030141C
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFE10301430
FreeLibrary.KERNEL32 ref: 00007FFE10301439
GetModuleHandleA.KERNEL32 ref: 00007FFE10301466
GetProcAddress.KERNEL32 ref: 00007FFE10301484
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFE10301498
GetModuleHandleA.KERNEL32 ref: 00007FFE103014C5
GetProcAddress.KERNEL32 ref: 00007FFE103014E3
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFE103014F7
PyEval_SaveThread.PYTHON3 ref: 00007FFE1030151D
LoadLibraryA.KERNEL32 ref: 00007FFE1030152D
PyEval_RestoreThread.PYTHON3 ref: 00007FFE10301539
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFE1030154D
GetProcAddress.KERNEL32 ref: 00007FFE10301574
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFE10301588
FreeLibrary.KERNEL32 ref: 00007FFE10301591

Strings

GetActiveProcessorCount, xrefs: 00007FFE1030176C, 00007FFE10301781
NtQueryVirtualMemory, xrefs: 00007FFE10301689
RtlNtStatusToDosErrorNoTeb, xrefs: 00007FFE103016AC
WTSQuerySessionInformationW, xrefs: 00007FFE103017C6
WTSEnumerateSessionsW, xrefs: 00007FFE103017AC
GetTickCount64, xrefs: 00007FFE103016EA, 00007FFE103016FF
NtSetInformationProcess, xrefs: 00007FFE103014D9, 00007FFE103014EE
GetLogicalProcessorInformationEx, xrefs: 00007FFE10301792
WTSFreeMemory, xrefs: 00007FFE103017E0
iphlpapi.dll, xrefs: 00007FFE103015E1, 00007FFE10301604
GetExtendedUdpTable, xrefs: 00007FFE103015FD
NtQueryObject, xrefs: 00007FFE1030156A, 00007FFE1030157F
NtResumeProcess, xrefs: 00007FFE10301666
RtlGetVersion, xrefs: 00007FFE10301620
wtsapi32.dll, xrefs: 00007FFE103017BA, 00007FFE103017D4, 00007FFE103017EE
RtlIpv4AddressToStringA, xrefs: 00007FFE103015B0
GetExtendedTcpTable, xrefs: 00007FFE103015DA
NtSuspendProcess, xrefs: 00007FFE10301643
kernel32, xrefs: 00007FFE103016CF, 00007FFE103016E1, 00007FFE10301751, 00007FFE10301763, 00007FFE103017A0
NtQueryInformationProcess, xrefs: 00007FFE1030147A, 00007FFE1030148F
ntdll.dll, xrefs: 00007FFE103013E0, 00007FFE10301401, 00007FFE10301458, 00007FFE10301471, 00007FFE103014B7, 00007FFE103014D0, 00007FFE10301523, 00007FFE10301544, 00007FFE103015BE, 00007FFE10301627, 00007FFE10301735
ntdll, xrefs: 00007FFE1030164A, 00007FFE1030166D, 00007FFE10301690, 00007FFE103016B3
RtlIpv6AddressToStringA, xrefs: 00007FFE10301727
NtQuerySystemInformation, xrefs: 00007FFE10301412, 00007FFE10301427

Memory Dump Source

Source File: 00000001.00000002.2937676674.00007FFE10301000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE10300000, based on PE: true

Associated: 00000001.00000002.2937662597.00007FFE10300000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937692179.00007FFE1030B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937707021.00007FFE10310000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937729384.00007FFE10311000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10300000_3OQL58yflv.jbxd

Similarity

API ID: Err_FilenameFromWindowsWith$AddressEval_LibraryProcThread$FreeHandleLoadModuleRestoreSave
String ID: GetActiveProcessorCount$GetExtendedTcpTable$GetExtendedUdpTable$GetLogicalProcessorInformationEx$GetTickCount64$NtQueryInformationProcess$NtQueryObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtResumeProcess$NtSetInformationProcess$NtSuspendProcess$RtlGetVersion$RtlIpv4AddressToStringA$RtlIpv6AddressToStringA$RtlNtStatusToDosErrorNoTeb$WTSEnumerateSessionsW$WTSFreeMemory$WTSQuerySessionInformationW$iphlpapi.dll$kernel32$ntdll$ntdll.dll$wtsapi32.dll
API String ID: 3787047288-761253638
Opcode ID: 6b7c78cd98652e75907c508de1284e9f0e804c7fc3037098929c04c6a191e3dd
Instruction ID: aa05cc7b230b9b6ae742c1395d33c2af2db762a03f8ac27b2ffafffb53f4a0a6
Opcode Fuzzy Hash: 6b7c78cd98652e75907c508de1284e9f0e804c7fc3037098929c04c6a191e3dd
Instruction Fuzzy Hash: 04C1D360A0BF07C1EA599F17E88417D23A5BF48BA4F8458B5E60D463B9EF7CE7498300

Function 00007FFE13333CF0 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 183
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ffi_prep_cif.LIBFFI-8 ref: 00007FFE13333D54
ffi_call.LIBFFI-8 ref: 00007FFE13333DBF
PyErr_Occurred.PYTHON312 ref: 00007FFE13333E19
PyEval_SaveThread.PYTHON312 ref: 00007FFE13333E41
PyErr_SetString.PYTHON312 ref: 00007FFE13338A8E
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE13338A99
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13338ACC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13338ADB

Strings

exception: datatype misalignment, xrefs: 00007FFE13338BCC
exception: breakpoint encountered, xrefs: 00007FFE13338A7D
ctypes.set_exception, xrefs: 00007FFE13338B7D
exception: access violation reading %p, xrefs: 00007FFE13338BF5
No ffi_type for result, xrefs: 00007FFE13338A64
ffi_prep_cif failed, xrefs: 00007FFE13338A6D
exception: access violation writing %p, xrefs: 00007FFE13338C07
exception: single step, xrefs: 00007FFE13338BC0

Memory Dump Source

Source File: 00000001.00000002.2938679897.00007FFE13331000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000001.00000002.2938663210.00007FFE13330000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938699098.00007FFE13341000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938716121.00007FFE13348000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938732915.00007FFE1334C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938732915.00007FFE1334E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13330000_3OQL58yflv.jbxd

Similarity

API ID: Err_$_errno$Eval_FromOccurredSaveStringThreadWindowsffi_callffi_prep_cif
String ID: No ffi_type for result$ctypes.set_exception$exception: access violation reading %p$exception: access violation writing %p$exception: breakpoint encountered$exception: datatype misalignment$exception: single step$ffi_prep_cif failed
API String ID: 1937973484-3190153140
Opcode ID: 6090977515b6261267277a6748370cd29b038abdf268df317b25d1ce47fdd96b
Instruction ID: 536a3bdbc2f3c6bd350682359eee4752af9fe59eee9a777709f0c929b37fe2aa
Opcode Fuzzy Hash: 6090977515b6261267277a6748370cd29b038abdf268df317b25d1ce47fdd96b
Instruction Fuzzy Hash: 61913E72A0DE428AE7648F13D440279AB60FB64FB4F5480B5D92E677B4DF3CE8498708

Function 00007FFE13332800 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

this function takes at least %d argument%s (%d given), xrefs: 00007FFE133377B0
NULL COM pointer access, xrefs: 00007FFE1333785F
this function takes %d argument%s (%d given), xrefs: 00007FFE133378A0
native com method call without 'this' parameter, xrefs: 00007FFE1333777E
COM method call without VTable, xrefs: 00007FFE13337787
Expected a COM this pointer as first argument, xrefs: 00007FFE13337805

Memory Dump Source

Source File: 00000001.00000002.2938679897.00007FFE13331000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000001.00000002.2938663210.00007FFE13330000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938699098.00007FFE13341000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938716121.00007FFE13348000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938732915.00007FFE1334C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938732915.00007FFE1334E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13330000_3OQL58yflv.jbxd

Similarity

API ID:
String ID: COM method call without VTable$Expected a COM this pointer as first argument$NULL COM pointer access$native com method call without 'this' parameter$this function takes %d argument%s (%d given)$this function takes at least %d argument%s (%d given)
API String ID: 0-1981512665
Opcode ID: 33f37c971fed54750540260edd76fa08e17a326f6354f15f3709b5b9b97763ef
Instruction ID: 6f886799e9b17f81fd106a96dfc743507a693470b86cde726588d18142b6fd2f
Opcode Fuzzy Hash: 33f37c971fed54750540260edd76fa08e17a326f6354f15f3709b5b9b97763ef
Instruction Fuzzy Hash: FF913822A09F4689EA65CB12E440379B7A0FB64FA4F4481B5DE6DA7774DF3CE444C708

Function 00007FFE1333430C Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 68
threadlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_ParseTuple.PYTHON312 ref: 00007FFE13334330
PySys_Audit.PYTHON312 ref: 00007FFE13334351
PyUnicode_AsWideCharString.PYTHON312 ref: 00007FFE13334362
PyEval_SaveThread.PYTHON312 ref: 00007FFE13334370
LoadLibraryExW.KERNEL32 ref: 00007FFE13334383
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1333439A
PyMem_Free.PYTHON312 ref: 00007FFE133343A3
PyLong_FromVoidPtr.PYTHON312 ref: 00007FFE133343BD
GetLastError.KERNEL32 ref: 00007FFE1333914E
PyErr_Format.PYTHON312 ref: 00007FFE13339171
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE1333917F

Strings

Could not find module '%.500S' (or one of its dependencies). Try using the full path with constructor syntax., xrefs: 00007FFE13339162
ctypes.dlopen, xrefs: 00007FFE1333434A
U|i:LoadLibrary, xrefs: 00007FFE13334329

Memory Dump Source

Source File: 00000001.00000002.2938679897.00007FFE13331000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000001.00000002.2938663210.00007FFE13330000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938699098.00007FFE13341000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938716121.00007FFE13348000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938732915.00007FFE1334C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938732915.00007FFE1334E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13330000_3OQL58yflv.jbxd

Similarity

API ID: Err_Eval_FromThread$Arg_AuditCharErrorFormatFreeLastLibraryLoadLong_Mem_ParseRestoreSaveStringSys_TupleUnicode_VoidWideWindows
String ID: Could not find module '%.500S' (or one of its dependencies). Try using the full path with constructor syntax.$U|i:LoadLibrary$ctypes.dlopen
API String ID: 3805577924-808210370
Opcode ID: 8ccda75d85a983fd95b13b23cc26be7dd2e7148b4e3e75719f774d01015a1fa9
Instruction ID: 479f9d101e297d3ca810a8af3bcb2b8db51d190c5d2086746c4818dc9016e6b5
Opcode Fuzzy Hash: 8ccda75d85a983fd95b13b23cc26be7dd2e7148b4e3e75719f774d01015a1fa9
Instruction Fuzzy Hash: 71213C25F08E4789FB149B53A8441B967A0AFA9FF5F4480B1C92E63370DE7CE4598309

Function 00007FFE13332AC0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FFE13332B67
PyObject_CallOneArg.PYTHON312 ref: 00007FFE13332BC2
_Py_Dealloc.PYTHON312 ref: 00007FFE13332D84
PyErr_Format.PYTHON312 ref: 00007FFE13337D0D

Strings

too many arguments (%zi), maximum is %i, xrefs: 00007FFE13337CFD
argument %zd: , xrefs: 00007FFE13337D5B

Memory Dump Source

Source File: 00000001.00000002.2938679897.00007FFE13331000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000001.00000002.2938663210.00007FFE13330000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938699098.00007FFE13341000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938716121.00007FFE13348000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938732915.00007FFE1334C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938732915.00007FFE1334E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13330000_3OQL58yflv.jbxd

Similarity

API ID: CallDeallocErr_FormatObject_memset
String ID: argument %zd: $too many arguments (%zi), maximum is %i
API String ID: 1791410686-4072972272
Opcode ID: c277ea183b50c61b7a84c05d1f4defa890b22ed5e8d0e49d552492417d3b1e46
Instruction ID: 40ff4865dd7da6279831af7573fd248ae85588c0fadfd66fe80502a409049505
Opcode Fuzzy Hash: c277ea183b50c61b7a84c05d1f4defa890b22ed5e8d0e49d552492417d3b1e46
Instruction Fuzzy Hash: 5CB15062A08E8289EA159F27D8402B9A360FB25FF8F548671D93DA77E5DF3CE541C304

Function 00007FFE133311AC Relevance: 12.1, APIs: 8, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyDict_Contains.PYTHON312 ref: 00007FFE13331F4C
PyDict_Update.PYTHON312 ref: 00007FFE13331F8A
_Py_Dealloc.PYTHON312 ref: 00007FFE13331FB2
PyDict_GetItemWithError.PYTHON312 ref: 00007FFE13331FF2
PyObject_SetAttr.PYTHON312 ref: 00007FFE13332011
PyErr_Occurred.PYTHON312 ref: 00007FFE13332032
_Py_Dealloc.PYTHON312 ref: 00007FFE133372B4

Part of subcall function 00007FFE133323D0: _PyThreadState_GetCurrent.PYTHON312(?,?,?,?,?,00007FFE13331F6C), ref: 00007FFE133323DD
Part of subcall function 00007FFE133323D0: _PyObject_MakeTpCall.PYTHON312 ref: 00007FFE1333241C

Memory Dump Source

Source File: 00000001.00000002.2938679897.00007FFE13331000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000001.00000002.2938663210.00007FFE13330000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938699098.00007FFE13341000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938716121.00007FFE13348000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938732915.00007FFE1334C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938732915.00007FFE1334E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13330000_3OQL58yflv.jbxd

Similarity

API ID: Dict_$DeallocObject_$AttrCallContainsCurrentErr_ErrorItemMakeOccurredState_ThreadUpdateWith
String ID:
API String ID: 2347184808-0
Opcode ID: 19253d0d72e99eb2dfa4533fb5b10f5266ade0fd6e35b992c2445b8af10077c0
Instruction ID: 5b07fcc8bbfeae7b018d26e265ea1b9400c83fe901525eee43665172da001c3b
Opcode Fuzzy Hash: 19253d0d72e99eb2dfa4533fb5b10f5266ade0fd6e35b992c2445b8af10077c0
Instruction Fuzzy Hash: 32415C31E0DE0289EA554B27D5443B9A3A0EF65FB5F1881B0D96DA66B5DF3CE054C308

Function 00007FFE103012C0 Relevance: 10.5, APIs: 7, Instructions: 37
librarythreadloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyEval_SaveThread.PYTHON3 ref: 00007FFE103012DA
LoadLibraryA.KERNEL32 ref: 00007FFE103012E6
PyEval_RestoreThread.PYTHON3 ref: 00007FFE103012F2
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFE10301302
GetProcAddress.KERNEL32 ref: 00007FFE10301310
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFE10301320
FreeLibrary.KERNEL32 ref: 00007FFE10301329

Memory Dump Source

Source File: 00000001.00000002.2937676674.00007FFE10301000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE10300000, based on PE: true

Associated: 00000001.00000002.2937662597.00007FFE10300000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937692179.00007FFE1030B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937707021.00007FFE10310000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937729384.00007FFE10311000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10300000_3OQL58yflv.jbxd

Similarity

API ID: Err_Eval_FilenameFromLibraryThreadWindowsWith$AddressFreeLoadProcRestoreSave
String ID:
API String ID: 568911590-0
Opcode ID: e2200b3415209b6f4be3470a672ca2eac9ae6c36c8dafb9bbec9a9066c3d2c4c
Instruction ID: 2ade23626ef8990d33601e84b7d7a9b86021fd49ba252ace6edf5921675c0a2c
Opcode Fuzzy Hash: e2200b3415209b6f4be3470a672ca2eac9ae6c36c8dafb9bbec9a9066c3d2c4c
Instruction Fuzzy Hash: 4C012824B1AE4682EA189F23B91813E6361BF48FE0B4844B4DE4E07B6DDF3CE2458300

Function 00007FFE10253AB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyFrozenSet_New.PYTHON312 ref: 00007FFE10253ABB
EVP_MD_do_all_provided.LIBCRYPTO-3 ref: 00007FFE10253AE1
PyModule_AddObject.PYTHON312 ref: 00007FFE10253B01
_Py_Dealloc.PYTHON312 ref: 00007FFE1025543A

Strings

openssl_md_meth_names, xrefs: 00007FFE10253AF7

Memory Dump Source

Source File: 00000001.00000002.2937605131.00007FFE10251000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE10250000, based on PE: true

Associated: 00000001.00000002.2937591084.00007FFE10250000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2937619663.00007FFE10257000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2937634346.00007FFE1025C000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2937648359.00007FFE1025E000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10250000_3OQL58yflv.jbxd

Similarity

API ID: D_do_all_providedDeallocFrozenModule_ObjectSet_
String ID: openssl_md_meth_names
API String ID: 4100423519-1600430994
Opcode ID: 377f0c0f1d187c6f6c3e59a4c7b27003ffe99c0898c3aca503393d1ddc3b5551
Instruction ID: 58eb7784139b0a607053da05832a4de5a1b8555762de73ae8c0116d35cb2b45b
Opcode Fuzzy Hash: 377f0c0f1d187c6f6c3e59a4c7b27003ffe99c0898c3aca503393d1ddc3b5551
Instruction Fuzzy Hash: 2E0125B1A0CE4282E7244B62A8052F97B60FBC9779F445175DB4E867B2EF3CD544C708

Function 00007FFE13331F00 Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyDict_Contains.PYTHON312 ref: 00007FFE13331F4C
PyDict_Update.PYTHON312 ref: 00007FFE13331F8A
_Py_Dealloc.PYTHON312 ref: 00007FFE13331FB2
PyDict_GetItemWithError.PYTHON312 ref: 00007FFE13331FF2
PyObject_SetAttr.PYTHON312 ref: 00007FFE13332011
PyErr_Occurred.PYTHON312 ref: 00007FFE13332032
_Py_Dealloc.PYTHON312 ref: 00007FFE133372B4

Part of subcall function 00007FFE133323D0: _PyThreadState_GetCurrent.PYTHON312(?,?,?,?,?,00007FFE13331F6C), ref: 00007FFE133323DD
Part of subcall function 00007FFE133323D0: _PyObject_MakeTpCall.PYTHON312 ref: 00007FFE1333241C

Memory Dump Source

Source File: 00000001.00000002.2938679897.00007FFE13331000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13330000, based on PE: true

Associated: 00000001.00000002.2938663210.00007FFE13330000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938699098.00007FFE13341000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938716121.00007FFE13348000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938732915.00007FFE1334C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2938732915.00007FFE1334E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13330000_3OQL58yflv.jbxd

Similarity

API ID: Dict_$DeallocObject_$AttrCallContainsCurrentErr_ErrorItemMakeOccurredState_ThreadUpdateWith
String ID:
API String ID: 2347184808-0
Opcode ID: 5d96bae5d0e6a384cdd3300ec643e4a407cf7280fbfff140101e4f05a9a581a9
Instruction ID: 0de580147be543d4b1f222abe1d0d00fbfabc16189860ad1b02c3d6bdb0983cb
Opcode Fuzzy Hash: 5d96bae5d0e6a384cdd3300ec643e4a407cf7280fbfff140101e4f05a9a581a9
Instruction Fuzzy Hash: 29312731E09E4289EA558B17A4403A963A0FF65FE4F1881B1DA6DA67B4DE3CE4918308

Function 00000225EDFB00F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32(00000000,00000000), ref: 00000225EDFB0139
connect.WS2_32 ref: 00000225EDFB014E
recv.WS2_32 ref: 00000225EDFB0175

Strings

unMa, xrefs: 00000225EDFB01D4

Memory Dump Source

Source File: 00000001.00000002.2934511808.00000225EDFB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000225EDFB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_225edfb0000_3OQL58yflv.jbxd

Yara matches

Similarity

API ID: Socketconnectrecv
String ID: unMa
API String ID: 1489331942-1083050270
Opcode ID: 69169658327af5ec15c147cef2357b4be1f4972c36573bed2cf0edbceb0edd2d
Instruction ID: fb96363d479a459e7756df037c189c0446ef56148fca3512e8c1a6c1329d7a0d
Opcode Fuzzy Hash: 69169658327af5ec15c147cef2357b4be1f4972c36573bed2cf0edbceb0edd2d
Instruction Fuzzy Hash: 1221992275CD5C2BF22CA1AD381F73A25CAC799715F21903FF54AC62DADDA18C83019A

Function 00007FFE10301DC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimes.KERNEL32 ref: 00007FFE10301DD3
PyErr_SetFromWindowsErr.PYTHON3 ref: 00007FFE10301DDF
Py_BuildValue.PYTHON3 ref: 00007FFE10301E82

Strings

(ddd), xrefs: 00007FFE10301DF4

Memory Dump Source

Source File: 00000001.00000002.2937676674.00007FFE10301000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE10300000, based on PE: true

Associated: 00000001.00000002.2937662597.00007FFE10300000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937692179.00007FFE1030B000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937707021.00007FFE10310000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2937729384.00007FFE10311000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10300000_3OQL58yflv.jbxd

Similarity

API ID: BuildErr_FromSystemTimesValueWindows
String ID: (ddd)
API String ID: 2325294781-2401937087
Opcode ID: ba0bdbf672466f0367906313a703a410643c45962e3f53d94245850bb14888e0
Instruction ID: 51f947f681f96e04336893ea2530b72599460b139144caad439acbd6acc87553
Opcode Fuzzy Hash: ba0bdbf672466f0367906313a703a410643c45962e3f53d94245850bb14888e0
Instruction Fuzzy Hash: F211BC31E29F454FC557DB36994052AE3A9AFA6790B448322F50FB1F64E72CE1D68B00

Function 00007FFE10253B90 Relevance: 4.5, APIs: 3, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE10253B9D
PyType_FromSpecWithBases.PYTHON312 ref: 00007FFE10253BB5
PyModule_AddType.PYTHON312 ref: 00007FFE10253BCA

Memory Dump Source

Source File: 00000001.00000002.2937605131.00007FFE10251000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFE10250000, based on PE: true

Associated: 00000001.00000002.2937591084.00007FFE10250000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2937619663.00007FFE10257000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2937634346.00007FFE1025C000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000001.00000002.2937648359.00007FFE1025E000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10250000_3OQL58yflv.jbxd

Similarity

API ID: Module_$BasesFromSpecStateTypeType_With
String ID:
API String ID: 2730008912-0
Opcode ID: a8ae01e82ce562809f66ae8afd9001b3d796d883e62a847821e8e3f5a0ad3511
Instruction ID: 00915aa0deffae1a53d927cec8e39c21067135ed93547044b48c4da9254cf4e1
Opcode Fuzzy Hash: a8ae01e82ce562809f66ae8afd9001b3d796d883e62a847821e8e3f5a0ad3511
Instruction Fuzzy Hash: B5F0BEA0709E0281EA148B26F4441B966A1BF88BF4F1881B5DF2D467A6FF3CD040C304

Function 00007FFE148E4730 Relevance: 1.5, APIs: 1, Instructions: 25threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00007FFE148E4493), ref: 00007FFE148E476E

Memory Dump Source

Source File: 00000001.00000002.2938782983.00007FFE148E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE148E0000, based on PE: true

Associated: 00000001.00000002.2938766117.00007FFE148E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2938800022.00007FFE148E6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2938816672.00007FFE148E9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148e0000_3OQL58yflv.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: d0030d7d39ed1f1285109f3f3c4a92fc536e9fee5458ecd4838dc556b7ba0fb5
Instruction ID: 78ea90a76b9f2e9161044804ee226d490219f8357c16d87d6016a8b7e211c75d
Opcode Fuzzy Hash: d0030d7d39ed1f1285109f3f3c4a92fc536e9fee5458ecd4838dc556b7ba0fb5
Instruction Fuzzy Hash: 29F01DB2508F45C9C702CF5AE45009DB724F756BD5F418A22EE8D63B29CF38C055CB50

Function 00007FFE148E42E0 Relevance: 1.4, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFE148E4379

Memory Dump Source

Source File: 00000001.00000002.2938782983.00007FFE148E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFE148E0000, based on PE: true

Associated: 00000001.00000002.2938766117.00007FFE148E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2938800022.00007FFE148E6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2938816672.00007FFE148E9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148e0000_3OQL58yflv.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b007cc5a7efe170316438a21b032e88e071ebebb1f436b5cacc6e359ddb69198
Instruction ID: 8b0becd7bc32e01ef9077e9173146ae9a1d557fb18be035d7b3935749b4477a6
Opcode Fuzzy Hash: b007cc5a7efe170316438a21b032e88e071ebebb1f436b5cacc6e359ddb69198
Instruction Fuzzy Hash: A5518F72B05F8585DB10CF2AD4845A8B364FB4AFB8B558272EE2C177A5DF38D859C340

Non-executed Functions

Function 00007FFE130C1630 Relevance: 49.2, APIs: 24, Strings: 4, Instructions: 169threadfilesynchronizationCOMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON312(?,?,?,00007FFE130C10AF), ref: 00007FFE130C1695
PyUnicode_AsWideCharString.PYTHON312(?,?,?,00007FFE130C10AF), ref: 00007FFE130C16A4
_wcsnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE130C10AF), ref: 00007FFE130C16C2
PyMem_Free.PYTHON312(?,?,?,00007FFE130C10AF), ref: 00007FFE130C16D1
PyErr_SetString.PYTHON312(?,?,?,00007FFE130C10AF), ref: 00007FFE130C16E8
PyEval_SaveThread.PYTHON312(?,?,?,00007FFE130C10AF), ref: 00007FFE130C1717
CreatePipe.KERNEL32(?,?,?,00007FFE130C10AF), ref: 00007FFE130C1730
GetLastError.KERNEL32(?,?,?,00007FFE130C10AF), ref: 00007FFE130C173A
CreateThread.KERNEL32 ref: 00007FFE130C1760
GetLastError.KERNEL32(?,?,?,00007FFE130C10AF), ref: 00007FFE130C176E
CloseHandle.KERNEL32(?,?,?,00007FFE130C10AF), ref: 00007FFE130C177D
ReadFile.KERNEL32(?,?,?,00007FFE130C10AF), ref: 00007FFE130C17B6
GetLastError.KERNEL32(?,?,?,00007FFE130C10AF), ref: 00007FFE130C17D2
CloseHandle.KERNEL32(?,?,?,00007FFE130C10AF), ref: 00007FFE130C17F4
WaitForSingleObject.KERNEL32(?,?,?,00007FFE130C10AF), ref: 00007FFE130C1802
GetExitCodeThread.KERNEL32(?,?,?,00007FFE130C10AF), ref: 00007FFE130C183B
GetLastError.KERNEL32(?,?,?,00007FFE130C10AF), ref: 00007FFE130C1845
CloseHandle.KERNEL32(?,?,?,00007FFE130C10AF), ref: 00007FFE130C1852
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFE130C10AF), ref: 00007FFE130C185B
PyMem_Free.PYTHON312(?,?,?,00007FFE130C10AF), ref: 00007FFE130C1866
PyErr_Format.PYTHON312(?,?,?,00007FFE130C10AF), ref: 00007FFE130C188F
PyErr_SetFromWindowsErr.PYTHON312(?,?,?,00007FFE130C10AF), ref: 00007FFE130C189E
PyUnicode_FromStringAndSize.PYTHON312(?,?,?,00007FFE130C10AF), ref: 00007FFE130C18B1
PyUnicode_FromWideChar.PYTHON312(?,?,?,00007FFE130C10AF), ref: 00007FFE130C18C9

Strings

_wmi.exec_query, xrefs: 00007FFE130C1667
only SELECT queries are supported, xrefs: 00007FFE130C16DE
select , xrefs: 00007FFE130C16BB
Query returns more than %zd characters, xrefs: 00007FFE130C187F

Memory Dump Source

Source File: 00000001.00000002.2938510031.00007FFE130C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2938494029.00007FFE130C0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938526688.00007FFE130C4000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938542624.00007FFE130C6000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938561193.00007FFE130C7000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLastThread$CloseErr_FromHandleStringUnicode_$CharCreateEval_FreeMem_Wide$AuditCodeExitFileFormatObjectPipeReadRestoreSaveSingleSizeSys_WaitWindows_wcsnicmp
String ID: Query returns more than %zd characters$_wmi.exec_query$only SELECT queries are supported$select
API String ID: 1485273037-3471808114
Opcode ID: a45e1f8a1551fef1ad70d41504f7adbe819fd0314a9c8daddda802135660b56e
Instruction ID: 48d7b8bca8d878caf7536bdd58416c24ad3446ee5c479e3062a8dd78fea46564
Opcode Fuzzy Hash: a45e1f8a1551fef1ad70d41504f7adbe819fd0314a9c8daddda802135660b56e
Instruction Fuzzy Hash: 75717F21A1CE428AEB558F22E45453A63F2FFA47A0F9141F5EA4E72A74DF3CE449C700

Function 00007FFE0138F500 Relevance: 42.5, APIs: 11, Strings: 13, Instructions: 485COMMON

Download Yara Rule

Strings

CompareStringEx, xrefs: 00007FFE013D1959
GetLocaleInfoEx, xrefs: 00007FFE013D1AE8
EnumSystemLocalesEx, xrefs: 00007FFE013D19DE
AppPolicyGetThreadInitializationType, xrefs: 00007FFE013D1918
RoInitialize, xrefs: 00007FFE013D1A22, 00007FFE013D1B2C
GetUserDefaultLocaleName, xrefs: 00007FFE013D1BF2
LocaleNameToLCID, xrefs: 00007FFE013D1E05
LCIDToLocaleName, xrefs: 00007FFE013D1D81
GetDateFormatEx, xrefs: 00007FFE013D1A63
IsValidLocaleName, xrefs: 00007FFE013D199D, 00007FFE013D1AA7, 00007FFE013D1BB1, 00007FFE013D1C36, 00007FFE013D1C77, 00007FFE013D1CBB, 00007FFE013D1DC5
LCMapStringEx, xrefs: 00007FFE013D1CFC
GetTimeFormatEx, xrefs: 00007FFE013D1B6D
AreFileApisANSI, xrefs: 00007FFE013D18D4

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID:
String ID: AppPolicyGetThreadInitializationType$AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID$RoInitialize
API String ID: 0-3669283627
Opcode ID: ccc7eb3572c774f940782ce753bf629e2723892d1cb137de11e9bfab3df123ae
Instruction ID: bab90575b3bb117926b552a72dfd5bd2689b17cb37496dcea395b5b8c28a2abe
Opcode Fuzzy Hash: ccc7eb3572c774f940782ce753bf629e2723892d1cb137de11e9bfab3df123ae
Instruction Fuzzy Hash: A11241A5B1AB0386FF589719F8601B463E2AF597C8F4A553ADC4D8F774EE2CF4488240

Function 00007FFE130C10C0 Relevance: 33.6, APIs: 17, Strings: 2, Instructions: 351memoryCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FFE130C1122
SysAllocString.OLEAUT32 ref: 00007FFE130C11D4
SysFreeString.OLEAUT32 ref: 00007FFE130C122D
SysAllocString.OLEAUT32 ref: 00007FFE130C1299

Strings

WQL, xrefs: 00007FFE130C12DB
ROOT\CIMV2, xrefs: 00007FFE130C11C2

Memory Dump Source

Source File: 00000001.00000002.2938510031.00007FFE130C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2938494029.00007FFE130C0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938526688.00007FFE130C4000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938542624.00007FFE130C6000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938561193.00007FFE130C7000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_3OQL58yflv.jbxd

Similarity

API ID: String$Alloc$CloseFreeHandle
String ID: ROOT\CIMV2$WQL
API String ID: 1604210422-3419750859
Opcode ID: 4753793dc133eb732f6fa59753c114e4776a8554c0160e4ccf7448882cbb55c5
Instruction ID: 39e24e9a47eaa0f5dcc90fda9d98fdb926428e863680f139b95488e426729496
Opcode Fuzzy Hash: 4753793dc133eb732f6fa59753c114e4776a8554c0160e4ccf7448882cbb55c5
Instruction Fuzzy Hash: 71F16E36608F42CAEB148B66E48026D77E6FB94BA4F9045B5DA9E63BB4CF3CD445C700

Function 00007FFE0138C950 Relevance: 31.9, APIs: 16, Strings: 2, Instructions: 364COMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0138CA72
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0138CAD8
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0138CB32
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0138CB78
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0138CB7E
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0138CBC4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0138CBCA
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0138CC15

Strings

LCMapStringEx, xrefs: 00007FFE0138CA98
FlsGetValue, xrefs: 00007FFE013D0C1A, 00007FFE013D0CAC, 00007FFE013D0D37, 00007FFE013D0DBF

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast
String ID: FlsGetValue$LCMapStringEx
API String ID: 1452528299-552164261
Opcode ID: a4a3e404a377be3de1b46447ce64a00db81dfcc42e9d28b1fd0d603e0ea3923b
Instruction ID: b922c8e81f00aaef35d1688849bf605ec2069de386bb1134eea44bbe6f0ee54b
Opcode Fuzzy Hash: a4a3e404a377be3de1b46447ce64a00db81dfcc42e9d28b1fd0d603e0ea3923b
Instruction Fuzzy Hash: B1E19065B09B4382EF589B69E8601BC23A1AF49BC8F455436DD8E5F7B1DE3CF8458310

Function 00007FFE130C30AC Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE130C30C8
memset.VCRUNTIME140 ref: 00007FFE130C30EC
RtlCaptureContext.KERNEL32 ref: 00007FFE130C30F5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE130C310F
RtlVirtualUnwind.KERNEL32 ref: 00007FFE130C3150
memset.VCRUNTIME140 ref: 00007FFE130C3183
IsDebuggerPresent.KERNEL32 ref: 00007FFE130C31A4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE130C31C5
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE130C31D0

Memory Dump Source

Source File: 00000001.00000002.2938510031.00007FFE130C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2938494029.00007FFE130C0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938526688.00007FFE130C4000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938542624.00007FFE130C6000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938561193.00007FFE130C7000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 0c3bbc9a044c8cfdc3e11b6ab6d67702d9a512d4181119069a997b409eff2317
Instruction ID: 1f816e99df857cf632df6c9d47a9283ee437f946f6fe9628af4fea9fbd847c11
Opcode Fuzzy Hash: 0c3bbc9a044c8cfdc3e11b6ab6d67702d9a512d4181119069a997b409eff2317
Instruction Fuzzy Hash: 83316D72618F818AEB609F61E8503E973B2FB94754F9440B9DA4D67BA8DF3CD648C700

Function 00007FFE10231960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE1023197C
memset.VCRUNTIME140 ref: 00007FFE102319A0
RtlCaptureContext.KERNEL32 ref: 00007FFE102319A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE102319C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFE10231A04
memset.VCRUNTIME140 ref: 00007FFE10231A37
IsDebuggerPresent.KERNEL32 ref: 00007FFE10231A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE10231A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE10231A84

Memory Dump Source

Source File: 00000001.00000002.2937462956.00007FFE10231000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFE10230000, based on PE: true

Associated: 00000001.00000002.2937447788.00007FFE10230000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2937477787.00007FFE10235000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2937492187.00007FFE10236000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2937505821.00007FFE10237000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10230000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 36b791249e45fdaaaa5c0498a025d542db75cf109b22524036ed28c1776144b0
Instruction ID: 5db259394f198ed95fd5bbf948647e48b19d317bb5ed261ca1e2f7c557e03ba1
Opcode Fuzzy Hash: 36b791249e45fdaaaa5c0498a025d542db75cf109b22524036ed28c1776144b0
Instruction Fuzzy Hash: 27315C72609E818AEB648F61E8503E97770FB88754F44447ADB4D4BBA9DF38D648C710

Function 00007FFE11EB3C90 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE11EB3CAC
memset.VCRUNTIME140 ref: 00007FFE11EB3CD0
RtlCaptureContext.KERNEL32 ref: 00007FFE11EB3CD9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE11EB3CF3
RtlVirtualUnwind.KERNEL32 ref: 00007FFE11EB3D34
memset.VCRUNTIME140 ref: 00007FFE11EB3D67
IsDebuggerPresent.KERNEL32 ref: 00007FFE11EB3D88
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE11EB3DA9
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE11EB3DB4

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 518508342acd5e1eb00bf798bb00ba5409c2c6d7c632951b2cf7e2fecbefcf67
Instruction ID: 81892ac161cfb0337b2d438fd7757a3cb887875f1243641709207ab05777af6e
Opcode Fuzzy Hash: 518508342acd5e1eb00bf798bb00ba5409c2c6d7c632951b2cf7e2fecbefcf67
Instruction Fuzzy Hash: DD313E72609F8189EB609FA1E8407EE7364FB84754F44447ADA4E47BA4DF3CD648C714

Function 00007FFE12E11960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE12E1197C
memset.VCRUNTIME140 ref: 00007FFE12E119A0
RtlCaptureContext.KERNEL32 ref: 00007FFE12E119A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE12E119C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFE12E11A04
memset.VCRUNTIME140 ref: 00007FFE12E11A37
IsDebuggerPresent.KERNEL32 ref: 00007FFE12E11A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE12E11A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE12E11A84

Memory Dump Source

Source File: 00000001.00000002.2938442526.00007FFE12E11000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE12E10000, based on PE: true

Associated: 00000001.00000002.2938423619.00007FFE12E10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2938459898.00007FFE12E12000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2938476905.00007FFE12E14000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe12e10000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: d51bb506f30b3b5fdb72a703574b3b87f2bee8d52957f5e63ce3b87c7c7ed3f5
Instruction ID: f87d692d1c79941ff5ccb54cacb4f436aaa850b64861ab0c1561325ab915eb9b
Opcode Fuzzy Hash: d51bb506f30b3b5fdb72a703574b3b87f2bee8d52957f5e63ce3b87c7c7ed3f5
Instruction Fuzzy Hash: 8A316D72609F818AEB618F61EC503EE7361FB84754F44413ADA4E4BBA8DF78D648D710

Function 00007FFE0E141A80 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE0E141A9C
memset.VCRUNTIME140 ref: 00007FFE0E141AC0
RtlCaptureContext.KERNEL32 ref: 00007FFE0E141AC9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE0E141AE3
RtlVirtualUnwind.KERNEL32 ref: 00007FFE0E141B24
memset.VCRUNTIME140 ref: 00007FFE0E141B57
IsDebuggerPresent.KERNEL32 ref: 00007FFE0E141B78
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE0E141B99
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE0E141BA4

Memory Dump Source

Source File: 00000001.00000002.2936726409.00007FFE0E141000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FFE0E140000, based on PE: true

Associated: 00000001.00000002.2936712283.00007FFE0E140000.00000002.00000001.01000000.00000026.sdmpDownload File
Associated: 00000001.00000002.2936741361.00007FFE0E145000.00000002.00000001.01000000.00000026.sdmpDownload File
Associated: 00000001.00000002.2936757392.00007FFE0E14F000.00000004.00000001.01000000.00000026.sdmpDownload File
Associated: 00000001.00000002.2936771307.00007FFE0E150000.00000002.00000001.01000000.00000026.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe0e140000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 4daa35a496de95c00f3549ff2ee86a4c9bdd8fe61db81f85dce5350646ac50d2
Instruction ID: 7a582dc8a48ad2493705d9bdb4cf9e3d13b20d78e06b8adc857ac9d40558a92a
Opcode Fuzzy Hash: 4daa35a496de95c00f3549ff2ee86a4c9bdd8fe61db81f85dce5350646ac50d2
Instruction Fuzzy Hash: 8D313EB6709B819AEB609F60E8503ED7361FB84744F44443ADA8E47BA8EF38D648C710

Function 00007FFE110F1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE110F197C
memset.VCRUNTIME140 ref: 00007FFE110F19A0
RtlCaptureContext.KERNEL32 ref: 00007FFE110F19A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE110F19C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFE110F1A04
memset.VCRUNTIME140 ref: 00007FFE110F1A37
IsDebuggerPresent.KERNEL32 ref: 00007FFE110F1A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE110F1A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE110F1A84

Memory Dump Source

Source File: 00000001.00000002.2937820040.00007FFE110F1000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE110F0000, based on PE: true

Associated: 00000001.00000002.2937804998.00007FFE110F0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2937836088.00007FFE110F2000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2937851276.00007FFE110F4000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe110f0000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: d51bb506f30b3b5fdb72a703574b3b87f2bee8d52957f5e63ce3b87c7c7ed3f5
Instruction ID: a086e0e1c23a3c8d32083fb19f4ba8de8efe900cbb25476c68db47d94a414c95
Opcode Fuzzy Hash: d51bb506f30b3b5fdb72a703574b3b87f2bee8d52957f5e63ce3b87c7c7ed3f5
Instruction Fuzzy Hash: A6316F72A08FC28AEB608F61E8417EE736AFB85754F44403ADA4D47AA5DF3CD548C704

Function 00007FFE11BB1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE11BB197C
memset.VCRUNTIME140 ref: 00007FFE11BB19A0
RtlCaptureContext.KERNEL32 ref: 00007FFE11BB19A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE11BB19C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFE11BB1A04
memset.VCRUNTIME140 ref: 00007FFE11BB1A37
IsDebuggerPresent.KERNEL32 ref: 00007FFE11BB1A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE11BB1A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE11BB1A84

Memory Dump Source

Source File: 00000001.00000002.2938118027.00007FFE11BB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFE11BB0000, based on PE: true

Associated: 00000001.00000002.2938101310.00007FFE11BB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938133567.00007FFE11BB3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938149100.00007FFE11BB4000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938163229.00007FFE11BB5000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11bb0000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction ID: 474b3f1eb5ff5279099dfb4776e28c6eca051b41af99b92efbb36582051558bb
Opcode Fuzzy Hash: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction Fuzzy Hash: DC313C72609F81C9EB708F61E8507E97368FB88754F44503ADA8D47AA4DF3CD648C718

Function 00007FFE11071960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE1107197C
memset.VCRUNTIME140 ref: 00007FFE110719A0
RtlCaptureContext.KERNEL32 ref: 00007FFE110719A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE110719C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFE11071A04
memset.VCRUNTIME140 ref: 00007FFE11071A37
IsDebuggerPresent.KERNEL32 ref: 00007FFE11071A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE11071A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE11071A84

Memory Dump Source

Source File: 00000001.00000002.2937760077.00007FFE11071000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE11070000, based on PE: true

Associated: 00000001.00000002.2937744877.00007FFE11070000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2937775020.00007FFE11073000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2937790415.00007FFE11075000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11070000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction ID: c416dd9c510fcc56afb339bfd224ebd0c4df9c884e9ddd191f53198f672475b6
Opcode Fuzzy Hash: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction Fuzzy Hash: A3317272A08F8189EB609F61E8503ED736AFB84754F44403ADA8D47BA4DF3CD648C710

Function 00007FFE13301AC0 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE13301ADC
memset.VCRUNTIME140 ref: 00007FFE13301B00
RtlCaptureContext.KERNEL32 ref: 00007FFE13301B09
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE13301B23
RtlVirtualUnwind.KERNEL32 ref: 00007FFE13301B64
memset.VCRUNTIME140 ref: 00007FFE13301B97
IsDebuggerPresent.KERNEL32 ref: 00007FFE13301BB8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE13301BD9
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE13301BE4

Memory Dump Source

Source File: 00000001.00000002.2938594897.00007FFE13301000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2938578259.00007FFE13300000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938612939.00007FFE13303000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938629391.00007FFE13305000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938646123.00007FFE13306000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 396fb0676da42074f33246ab187dc1dcc5be145908329d2e9d3bbd097559ecec
Instruction ID: cf1446383e4bdbbcbd700f9940a1a325f71d6196e6fbe0414b5ec9aa183ed3a4
Opcode Fuzzy Hash: 396fb0676da42074f33246ab187dc1dcc5be145908329d2e9d3bbd097559ecec
Instruction Fuzzy Hash: D931A476A09F8189EB608F65E8503EE3364FB94764F444039DA9E67BA8DF3CD548C708

Function 00007FFE101D1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE101D197C
memset.VCRUNTIME140 ref: 00007FFE101D19A0
RtlCaptureContext.KERNEL32 ref: 00007FFE101D19A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE101D19C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFE101D1A04
memset.VCRUNTIME140 ref: 00007FFE101D1A37
IsDebuggerPresent.KERNEL32 ref: 00007FFE101D1A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE101D1A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE101D1A84

Memory Dump Source

Source File: 00000001.00000002.2937326239.00007FFE101D1000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFE101D0000, based on PE: true

Associated: 00000001.00000002.2937311108.00007FFE101D0000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000001.00000002.2937341468.00007FFE101D3000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000001.00000002.2937356318.00007FFE101D4000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000001.00000002.2937371175.00007FFE101D5000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe101d0000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction ID: d6ee73d3a60b8b7bdc80c61e5052e806b521b5a4faf90328e69341d1fd05b68c
Opcode Fuzzy Hash: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction Fuzzy Hash: 25313972709E819AFB608F61E8543E96364FB84758F44803ADB8E47BA8DF3CD648C710

Function 00007FFE0EA71960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE0EA7197C
memset.VCRUNTIME140 ref: 00007FFE0EA719A0
RtlCaptureContext.KERNEL32 ref: 00007FFE0EA719A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE0EA719C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFE0EA71A04
memset.VCRUNTIME140 ref: 00007FFE0EA71A37
IsDebuggerPresent.KERNEL32 ref: 00007FFE0EA71A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE0EA71A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE0EA71A84

Memory Dump Source

Source File: 00000001.00000002.2936942642.00007FFE0EA71000.00000020.00000001.01000000.00000023.sdmp, Offset: 00007FFE0EA70000, based on PE: true

Associated: 00000001.00000002.2936928583.00007FFE0EA70000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936956825.00007FFE0EA73000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936970557.00007FFE0EA74000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936984077.00007FFE0EA75000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe0ea70000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction ID: dd6dfbbfe73157e12aad8afbfa340118929cd95550e7b364656e1a4918147f49
Opcode Fuzzy Hash: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction Fuzzy Hash: 8C314D72609B8189EB60CF60E8507ED73B4FB98744F45403ADACE47AA4EF38D649C710

Function 00007FFE11513398 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE115133B4
memset.VCRUNTIME140 ref: 00007FFE115133D8
RtlCaptureContext.KERNEL32 ref: 00007FFE115133E1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE115133FB
RtlVirtualUnwind.KERNEL32 ref: 00007FFE1151343C
memset.VCRUNTIME140 ref: 00007FFE1151346F
IsDebuggerPresent.KERNEL32 ref: 00007FFE11513490
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE115134B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE115134BC

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 35a7589cc452a559f716fbf76e6c2d0995ef5bb5efcdcd1d759a878c2b8be3e9
Instruction ID: 0edbfea2b43553706825a04faf3d2aa5a84438fc5c5b8296166cfdbc6fc306d2
Opcode Fuzzy Hash: 35a7589cc452a559f716fbf76e6c2d0995ef5bb5efcdcd1d759a878c2b8be3e9
Instruction Fuzzy Hash: 0B316D72609E818AEB618F61E8503ED7379FB84764F44443ADA4E47BA5EF3CC648C700

Function 00007FFE10231D30 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFE10231DF3
_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE10231ED9
memcpy.VCRUNTIME140 ref: 00007FFE10231F0E

Strings

D:\a\pycryptodome\pycryptodome\src\hash_SHA2_template.c, xrefs: 00007FFE10231ECB, 00007FFE10231F76
hs->curlen < BLOCK_SIZE, xrefs: 00007FFE10231ED2, 00007FFE10231F7D

Memory Dump Source

Source File: 00000001.00000002.2937462956.00007FFE10231000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFE10230000, based on PE: true

Associated: 00000001.00000002.2937447788.00007FFE10230000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2937477787.00007FFE10235000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2937492187.00007FFE10236000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2937505821.00007FFE10237000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10230000_3OQL58yflv.jbxd

Similarity

API ID: memcpy$_wassert
String ID: D:\a\pycryptodome\pycryptodome\src\hash_SHA2_template.c$hs->curlen < BLOCK_SIZE
API String ID: 4178124637-3286700114
Opcode ID: 9fd48034940160ff137dafc7768c8653c858100760cfcc45bc03f43c08ef4dc7
Instruction ID: 2f7c8878b0fdfc5b528361a535f2c92b53499429088df62b01193ed62add5da0
Opcode Fuzzy Hash: 9fd48034940160ff137dafc7768c8653c858100760cfcc45bc03f43c08ef4dc7
Instruction Fuzzy Hash: C0B1BF22E18B918AE705CB39C9006F96B61FBD9798F059231EF4D16B56DF38E589C300

Function 00007FFE11515074 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47threadnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE11513D80: PyErr_Format.PYTHON312 ref: 00007FFE11514102

PySys_Audit.PYTHON312 ref: 00007FFE115150CC
PyEval_SaveThread.PYTHON312 ref: 00007FFE115150DE
bind.WS2_32 ref: 00007FFE115150F5
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11515100

Strings

socket.bind, xrefs: 00007FFE115150C5
bind, xrefs: 00007FFE11515093

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Eval_Thread$AuditErr_FormatRestoreSaveSys_bind
String ID: bind$socket.bind
API String ID: 1695574521-187351271
Opcode ID: 77259c4cc41cffc2c3f1a4c23cf7c52fadd24801fbce19dc13b5509f2f44b2df
Instruction ID: 678f39d033c0412faf22e480172bcae9d5ed5ff02f4d7ea20f85db2702a3a2d8
Opcode Fuzzy Hash: 77259c4cc41cffc2c3f1a4c23cf7c52fadd24801fbce19dc13b5509f2f44b2df
Instruction Fuzzy Hash: A3113061A1CF8281EB229B62F4443AA736AFF497A4F441176DA8D43B74EF3CE544C700

Function 00007FFE013F0F30 Relevance: 9.1, APIs: 6, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FFE013F0FA2
RtlLookupFunctionEntry.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FFE013F0FBA
RtlVirtualUnwind.API-MS-WIN-CORE-RTLSUPPORT-L1-1-0 ref: 00007FFE013F0FF5
IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0 ref: 00007FFE013F1032
SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE013F103C
UnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE013F1047

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 50aacc1ba8ac63494cc2825d4720d0296b93f697952a9719d0efef972ad78f68
Instruction ID: 95a7c2cddedb830fca61700d3f7fc7bc1951d4d834d7aae6fe44a9f5579e8518
Opcode Fuzzy Hash: 50aacc1ba8ac63494cc2825d4720d0296b93f697952a9719d0efef972ad78f68
Instruction Fuzzy Hash: 1A313F76608B82C6DB609F25E8403E973A4FB88B48F55013AEB8D4BB69DF7CD545CB00

Function 00007FFE013EF8D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,00000002,00007FFE013EFC4E,?,?,?,00000000,?,00000092,?), ref: 00007FFE013EF925
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,00000002,00007FFE013EFC4E,?,?,?,00000000,?,00000092,?), ref: 00007FFE013EF969
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,00000002,00007FFE013EFC4E,?,?,?,00000000,?,00000092,?), ref: 00007FFE013EF97F

Strings

OCP, xrefs: 00007FFE013EF901
ACP, xrefs: 00007FFE013EF8F1

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 73773a8882f4d354970d23b90f74c2a86361736c284bf30165171261c67cd652
Instruction ID: 95ffff4af748a9e6f4c8616363938c211179d3b801bb71f5f89a196154f884de
Opcode Fuzzy Hash: 73773a8882f4d354970d23b90f74c2a86361736c284bf30165171261c67cd652
Instruction Fuzzy Hash: 87218131A0C78392FB208B11E4405BAA3A9FF59784F554035EA8D4B6F8DFBDE845C740

Function 00007FFE11516078 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1151609B
PyEval_SaveThread.PYTHON312 ref: 00007FFE115160B3
listen.WS2_32 ref: 00007FFE115160CE
PyEval_RestoreThread.PYTHON312 ref: 00007FFE115160D9

Strings

|i:listen, xrefs: 00007FFE11516094

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Eval_Thread$Arg_ParseRestoreSaveSizeTuple_listen
String ID: |i:listen
API String ID: 3610171639-1087349693
Opcode ID: 1dd604d63779131d74f0e04f3b2c61a42505648cc2c7e148056a803314711aa5
Instruction ID: b1bb20b004de9d352861dae4f4f3015c6030e67bea28408d4d7ec14d7082370a
Opcode Fuzzy Hash: 1dd604d63779131d74f0e04f3b2c61a42505648cc2c7e148056a803314711aa5
Instruction Fuzzy Hash: C3014021B1CF8283EB468B57E48406A637AFF84BA0F1441B5DA4E43B74EF7CE4948700

Function 00007FFE01425E74 Relevance: 7.8, APIs: 5, Instructions: 327fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FFE01425EEC
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFE014261A6
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFE014261F6
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE014262C9
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01426328

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: fa85c37a5e9ba8bf9035f2b110f334415420467121762107b6b96761b37d1af9
Instruction ID: 7ea428088fc73bfd4705d506268eea354462677e0e75ee263f6cfa2dde86f908
Opcode Fuzzy Hash: fa85c37a5e9ba8bf9035f2b110f334415420467121762107b6b96761b37d1af9
Instruction Fuzzy Hash: A4D11032B19A818AEB10CF74D4402AD7BB1FB55B98F554135DE4E5BBA9DE3CE44AC300

Function 00007FFE013EFA58 Relevance: 7.7, APIs: 5, Instructions: 200COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE01392900: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013F2861), ref: 00007FFE0139290A
Part of subcall function 00007FFE01392900: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013F2861), ref: 00007FFE01392950

Part of subcall function 00007FFE01392900: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013F2861), ref: 00007FFE013929A3

GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFE013EFC20
IsValidCodePage.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFE013EFC5B
IsValidLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFE013EFC75
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFE013EFCC2
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00000000,?,00000092,?), ref: 00007FFE013EFCE1

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid$CodeDefaultPageUser
String ID:
API String ID: 1491647067-0
Opcode ID: 8bc2d49000242995dabf5c358893cb775ecc986712979215801f7b5831ed4e28
Instruction ID: da947917f2cd3e3237aa73d017f93ca7708f04a72f81bd7b804411e6030264c1
Opcode Fuzzy Hash: 8bc2d49000242995dabf5c358893cb775ecc986712979215801f7b5831ed4e28
Instruction Fuzzy Hash: 76816972A0C74286FB20DB60D8912BE33E8BB54B48F564435DE0D5B2E8EEBCE945C350

Function 00007FFE0139D5C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,00007FFE01381679), ref: 00007FFE0139D65F
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,00007FFE01381679), ref: 00007FFE013D5F8C

Strings

IsValidLocaleName, xrefs: 00007FFE013D5F3E
GetLocaleInfoEx, xrefs: 00007FFE0139D655

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressInfoLocaleProc
String ID: GetLocaleInfoEx$IsValidLocaleName
API String ID: 2353564440-3594675595
Opcode ID: 3d67c95f89377f80dc67d7afe21c7dc6fd59030b2bd6784bef41434d6fe2efc1
Instruction ID: c2b13d5088402fae92a36dc2678db7181b23a7444e02e8a07aad022c4c8c61e0
Opcode Fuzzy Hash: 3d67c95f89377f80dc67d7afe21c7dc6fd59030b2bd6784bef41434d6fe2efc1
Instruction Fuzzy Hash: 8731DF21B09B0282FB148B16B8101B563E0AF58BE8F4A5535ED5D5F7B8EE3CE8458380

Function 00007FFE013C98F4 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0(?,?,00000000,00007FFE013C9AEB,?,?,?,?,00007FFE013C9A46,?,?,?,?,00007FFE013D0F58), ref: 00007FFE013C98FD
SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FFE013C9AEB,?,?,?,?,00007FFE013C9A46,?,?,?,?,00007FFE013D0F58), ref: 00007FFE013C9915
UnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FFE013C9AEB,?,?,?,?,00007FFE013C9A46,?,?,?,?,00007FFE013D0F58), ref: 00007FFE013C991E
GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FFE013C9AEB,?,?,?,?,00007FFE013C9A46,?,?,?,?,00007FFE013D0F58), ref: 00007FFE013C9937

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CurrentDebuggerPresentProcess
String ID:
API String ID: 2506494423-0
Opcode ID: bc0a17b56fa287744e782d3f3bb8d9390f05734331d2ca113270627cfd11d1bf
Instruction ID: 0c906b57959c97529fa53cc16d0741f286038e4c5e651d7a93cc5245d54873a0
Opcode Fuzzy Hash: bc0a17b56fa287744e782d3f3bb8d9390f05734331d2ca113270627cfd11d1bf
Instruction Fuzzy Hash: ABF07D71E09A06C6FB546B71E8153B46251EF99B4EF051434D90E4E2B1DFBD64C5CB40

Function 00007FFE013ED2F0 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FFE01381718), ref: 00007FFE013ED31C
EnumSystemLocalesW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,00000000,?,00007FFE01381718), ref: 00007FFE013ED355
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00007FFE01381718), ref: 00007FFE013ED376

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: CriticalSection$EnterEnumLeaveLocalesSystem
String ID:
API String ID: 2886288447-0
Opcode ID: 38c71085e82ae7786b4cb33ebf5ae7edfef5d039e048a421b31bd6e5d3cf52f9
Instruction ID: 99e9de709527d2cd4aac8b07854816cf48e15b551fc88ad771b6ce41757a70a7
Opcode Fuzzy Hash: 38c71085e82ae7786b4cb33ebf5ae7edfef5d039e048a421b31bd6e5d3cf52f9
Instruction Fuzzy Hash: 19113932A08B4282EB00CB19F8901A96361FB98B88F845132EA8E87778DF3CE555C300

Function 00007FFE013EF3D4 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE01392900: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013F2861), ref: 00007FFE0139290A
Part of subcall function 00007FFE01392900: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013F2861), ref: 00007FFE01392950

GetPrimaryLen.LIBCMT ref: 00007FFE013EF43D
EnumSystemLocalesW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,00000040,00007FFE013EFBF3,?,?,?,00000000,?,00000092,?,?,?,00007FFE013D2084), ref: 00007FFE013EF452

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$EnumLocalesPrimarySystem
String ID:
API String ID: 1794546269-0
Opcode ID: 673be9be1899655fd0f1502e737552d3ef5fc48f47595e0e578b0b5e2ad3a46a
Instruction ID: 8450839b74bcff4c1b8742bef10ccbe699852cbf58d80b8a7c240842881fc90c
Opcode Fuzzy Hash: 673be9be1899655fd0f1502e737552d3ef5fc48f47595e0e578b0b5e2ad3a46a
Instruction Fuzzy Hash: A511C663A0C78586EB518F25E4402AD37E1EBA1BE0F558235D6194B3E9DE7CD581C740

Function 00007FFE013EF488 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE01392900: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013F2861), ref: 00007FFE0139290A
Part of subcall function 00007FFE01392900: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013F2861), ref: 00007FFE01392950

GetPrimaryLen.LIBCMT ref: 00007FFE013EF4CC
EnumSystemLocalesW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,00000002,00007FFE013EFB72,?,?,?,00000000,?,00000092,?,?,?,00007FFE013D2084), ref: 00007FFE013EF4E4

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$EnumLocalesPrimarySystem
String ID:
API String ID: 1794546269-0
Opcode ID: 9715aa00748507d3cb7bd37f9afbfb145119054f98251216db61c65602e6372e
Instruction ID: 980d7ad53ee18c60c127228102f449002b832007b1ffe7bc4746292c700cb6b7
Opcode Fuzzy Hash: 9715aa00748507d3cb7bd37f9afbfb145119054f98251216db61c65602e6372e
Instruction Fuzzy Hash: 98F0C8A3A0C78182FB014F25D44037976D5DBA07A4F168331D62C4B2F9DEBC94918B00

Function 00007FFE11516594 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE115165B1
recvfrom.WS2_32 ref: 00007FFE115165EE

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: memsetrecvfrom
String ID:
API String ID: 3853191257-0
Opcode ID: 1c1bb35f1ba1ca9bc52f53e3dda2dfb8550f660c07735227e8050b977bbad510
Instruction ID: 9888e748f31b6c05f7cdaffc4aef22ce5bf7f98f86b32d8c9c2cb44ff263d6a0
Opcode Fuzzy Hash: 1c1bb35f1ba1ca9bc52f53e3dda2dfb8550f660c07735227e8050b977bbad510
Instruction Fuzzy Hash: EDF01DB6A14F8582DB208F66E04016973B5F748FE8B648221DF6C477B8DF38C490C740

Function 00007FFE013EF36C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE01392900: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013F2861), ref: 00007FFE0139290A
Part of subcall function 00007FFE01392900: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013F2861), ref: 00007FFE01392950

EnumSystemLocalesW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,00000002,00007FFE013EFC17,?,?,?,00000000,?,00000092,?,?,?,00007FFE013D2084), ref: 00007FFE013EF3B3

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 42fa82f3de2ab80ec0cd7c09b23062035a529d418322d0db4325bc66b7f1d5e7
Instruction ID: aba8bcff1c89b1203eb6785a29f2002911645ed3c4d899dacec0b388438b3379
Opcode Fuzzy Hash: 42fa82f3de2ab80ec0cd7c09b23062035a529d418322d0db4325bc66b7f1d5e7
Instruction Fuzzy Hash: 51F08962B0878541DB105F75E5403A9B7E5EB94BB4F558231D678873F5CEBCC490C300

Function 00007FFE013C51E8 Relevance: 82.7, APIs: 44, Strings: 3, Instructions: 459COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE013C5294

Part of subcall function 00007FFE013C1894: DName::doPchar.LIBVCRUNTIME ref: 00007FFE013C18C6

DName::operator+.LIBVCRUNTIME ref: 00007FFE013C52A4

Part of subcall function 00007FFE013C1B40: DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C1B5B

DName::DName.LIBVCRUNTIME ref: 00007FFE013C5815
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C5836
DName::DName.LIBVCRUNTIME ref: 00007FFE013C587E
UnDecorator::getDecoratedName.LIBVCRUNTIME ref: 00007FFE013C5893
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C589F
UnDecorator::getSymbolName.LIBVCRUNTIME ref: 00007FFE013C58BC
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C58C8
DName::operator+=.LIBCMT ref: 00007FFE013C58D8
DName::operator=.LIBVCRUNTIME ref: 00007FFE013C527E

Part of subcall function 00007FFE013C1AB8: DName::doPchar.LIBVCRUNTIME ref: 00007FFE013C1AE0

DName::doPchar.LIBVCRUNTIME ref: 00007FFE013C531B
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C532B
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C5338
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C535D
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C5368
DName::doPchar.LIBVCRUNTIME ref: 00007FFE013C53E2
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C53F3
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C5417
DName::DName.LIBVCRUNTIME ref: 00007FFE013C54BD
DName::DName.LIBVCRUNTIME ref: 00007FFE013C5501
UnDecorator::getStringEncoding.LIBVCRUNTIME ref: 00007FFE013C5540
DName::operator=.LIBVCRUNTIME ref: 00007FFE013C55BF
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C55E0
DName::operator=.LIBVCRUNTIME ref: 00007FFE013C560D
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C5652
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFE013C565B
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C566A
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C5676
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFE013C567F
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C568E
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C569A
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFE013C56A3
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C56B2
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C56BE
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C56D8
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C56E4
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C56F3
UnDecorator::getDataType.LIBVCRUNTIME ref: 00007FFE013C5703
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C5713
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C5723
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C5732
DName::operator=.LIBVCRUNTIME ref: 00007FFE013C5754
DName::operator=.LIBVCRUNTIME ref: 00007FFE013C5931

Strings

operator, xrefs: 00007FFE013C5289
`string', xrefs: 00007FFE013C5535
`anonymous namespace', xrefs: 00007FFE013C5575

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+Name::operator+=$Decorator::getName$Name::Name::operator=$Name::doPchar$DimensionSigned$DataDecoratedEncodingStringSymbolType
String ID: `anonymous namespace'$`string'$operator
API String ID: 2020783597-815891235
Opcode ID: d2ab21432e8f2a8809b115bdb0fd4948e43d635353f358b1e98a5d3f26d501a5
Instruction ID: bcd7a0b2adf78ba6b7ba62fb01e87de04de797cb0f5a6645c56d5ff056a9b0aa
Opcode Fuzzy Hash: d2ab21432e8f2a8809b115bdb0fd4948e43d635353f358b1e98a5d3f26d501a5
Instruction Fuzzy Hash: CC228D62F19A6688FB14DB60D8902FD27B2BB15788F564032DA0E5F6BADF2CF545C300

Function 00007FFE013C3240 Relevance: 73.8, APIs: 17, Strings: 25, Instructions: 277COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator=.LIBVCRUNTIME ref: 00007FFE013C32CF
DName::DName.LIBVCRUNTIME ref: 00007FFE013C338C
UnDecorator::getECSUDataType.LIBVCRUNTIME ref: 00007FFE013C3440
DName::operator=.LIBVCRUNTIME ref: 00007FFE013C353F
DName::operator+=.LIBCMT ref: 00007FFE013C354F
DName::DName.LIBVCRUNTIME ref: 00007FFE013C3595
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C35A5
DName::doPchar.LIBVCRUNTIME ref: 00007FFE013C35D9
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C35E9
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C35F6
DName::operator=.LIBVCRUNTIME ref: 00007FFE013C3627
DName::operator+=.LIBCMT ref: 00007FFE013C363B
DName::operator=.LIBVCRUNTIME ref: 00007FFE013C3651
UnDecorator::getPtrRefType.LIBVCRUNTIME ref: 00007FFE013C3668
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C3688

Strings

void, xrefs: 00007FFE013C3511
const, xrefs: 00007FFE013C361C
volatile, xrefs: 00007FFE013C3630
long , xrefs: 00007FFE013C3534
<unknown>, xrefs: 00007FFE013C3496
int, xrefs: 00007FFE013C32E2
__int8, xrefs: 00007FFE013C3369
float, xrefs: 00007FFE013C32C4
__int64, xrefs: 00007FFE013C33E9
__w64 , xrefs: 00007FFE013C337E
__int128, xrefs: 00007FFE013C33DD
double, xrefs: 00007FFE013C3544
volatile, xrefs: 00007FFE013C3646
bool, xrefs: 00007FFE013C3401
char, xrefs: 00007FFE013C32F4
char16_t, xrefs: 00007FFE013C348A
UNKNOWN, xrefs: 00007FFE013C3466
__int32, xrefs: 00007FFE013C33F5
__int16, xrefs: 00007FFE013C33BE
long, xrefs: 00007FFE013C32D9
short, xrefs: 00007FFE013C32EB
wchar_t, xrefs: 00007FFE013C3472
signed , xrefs: 00007FFE013C358A
char32_t, xrefs: 00007FFE013C347E
unsigned , xrefs: 00007FFE013C3581

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator=$Name::operator+Name::operator+=$Decorator::getNameName::Type$DataName::doPchar
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $bool$char$char16_t$char32_t$const$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
API String ID: 1480303775-3737837666
Opcode ID: 98600e0f02437c323d5596bfd4853c04388376c0f65e739e1899551412cd3cea
Instruction ID: 849f06fdc58731df39017ff29cf77ec3364ceebe3df0934b21bb9605ad1084db
Opcode Fuzzy Hash: 98600e0f02437c323d5596bfd4853c04388376c0f65e739e1899551412cd3cea
Instruction Fuzzy Hash: E3D159A2E19A5395FB20DB94E8802BC73B2BF14394F928532DA0D9E6B5DF3CE544D300

Function 00007FFE11EB2610 Relevance: 73.7, APIs: 12, Strings: 30, Instructions: 229COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE11EB2627
PyTuple_New.PYTHON312 ref: 00007FFE11EB2632
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11EB2654
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11EB2670
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11EB268C
PyModule_AddIntConstant.PYTHON312 ref: 00007FFE11EB26A8

Part of subcall function 00007FFE11EB29F4: PyLong_FromLongLong.PYTHON312(?,?,?,00007FFE11EB26C8), ref: 00007FFE11EB2A0C
Part of subcall function 00007FFE11EB29F4: PyModule_AddObject.PYTHON312(?,?,?,00007FFE11EB26C8), ref: 00007FFE11EB2A23

PyErr_NewExceptionWithDoc.PYTHON312 ref: 00007FFE11EB2959
PyModule_AddType.PYTHON312 ref: 00007FFE11EB2972
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE11EB2989
PyModule_AddType.PYTHON312 ref: 00007FFE11EB299D
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FFE11EB29B4
PyModule_AddType.PYTHON312 ref: 00007FFE11EB29C9

Strings

FILTER_LZMA2, xrefs: 00007FFE11EB2781
MF_BT3, xrefs: 00007FFE11EB28A8
_lzma.LZMAError, xrefs: 00007FFE11EB2952
FILTER_ARM, xrefs: 00007FFE11EB27EC
FORMAT_ALONE, xrefs: 00007FFE11EB2685
MF_BT2, xrefs: 00007FFE11EB288D
CHECK_SHA256, xrefs: 00007FFE11EB270F
MF_HC3, xrefs: 00007FFE11EB2858
Call to liblzma failed., xrefs: 00007FFE11EB2948
FILTER_LZMA1, xrefs: 00007FFE11EB2763
CHECK_ID_MAX, xrefs: 00007FFE11EB272A
FILTER_POWERPC, xrefs: 00007FFE11EB283D
FILTER_IA64, xrefs: 00007FFE11EB27D1
MODE_NORMAL, xrefs: 00007FFE11EB28F9
FILTER_X86, xrefs: 00007FFE11EB27B3
MF_HC4, xrefs: 00007FFE11EB286F
CHECK_NONE, xrefs: 00007FFE11EB26B9
MODE_FAST, xrefs: 00007FFE11EB28DE
CHECK_CRC32, xrefs: 00007FFE11EB26D7
FILTER_ARMTHUMB, xrefs: 00007FFE11EB2807
FORMAT_AUTO, xrefs: 00007FFE11EB264A
FORMAT_RAW, xrefs: 00007FFE11EB26A1
FILTER_DELTA, xrefs: 00007FFE11EB279C
MF_BT4, xrefs: 00007FFE11EB28C3
FILTER_SPARC, xrefs: 00007FFE11EB2822
PRESET_DEFAULT, xrefs: 00007FFE11EB2914
CHECK_UNKNOWN, xrefs: 00007FFE11EB2745
CHECK_CRC64, xrefs: 00007FFE11EB26F4
PRESET_EXTREME, xrefs: 00007FFE11EB292E
FORMAT_XZ, xrefs: 00007FFE11EB2669

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Module_$Constant$FromType$LongModuleSpecType_$Err_ExceptionLong_ObjectStateTuple_With
String ID: CHECK_CRC32$CHECK_CRC64$CHECK_ID_MAX$CHECK_NONE$CHECK_SHA256$CHECK_UNKNOWN$Call to liblzma failed.$FILTER_ARM$FILTER_ARMTHUMB$FILTER_DELTA$FILTER_IA64$FILTER_LZMA1$FILTER_LZMA2$FILTER_POWERPC$FILTER_SPARC$FILTER_X86$FORMAT_ALONE$FORMAT_AUTO$FORMAT_RAW$FORMAT_XZ$MF_BT2$MF_BT3$MF_BT4$MF_HC3$MF_HC4$MODE_FAST$MODE_NORMAL$PRESET_DEFAULT$PRESET_EXTREME$_lzma.LZMAError
API String ID: 2322464913-730042774
Opcode ID: 8b66aa539901c0725c843410b367eb272ac3cb6589d1954789954729d8d46d13
Instruction ID: f2973c6a710d3634e7494f2cf6b3ed82124420baae19a77458fd07da80135695
Opcode Fuzzy Hash: 8b66aa539901c0725c843410b367eb272ac3cb6589d1954789954729d8d46d13
Instruction Fuzzy Hash: F8A18E20B08E1355E724ABA3ED416B7225DBF44BE0F4892B2CE5D86675DE2DF409C718

Function 00007FFE013C6B90 Relevance: 59.7, APIs: 30, Strings: 4, Instructions: 242COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getDecoratedName.LIBVCRUNTIME ref: 00007FFE013C6C10

Part of subcall function 00007FFE013C40A0: UnDecorator::getDataType.LIBVCRUNTIME ref: 00007FFE013C40E8

UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFE013C6C1E
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFE013C6C27
DName::getString.LIBVCRUNTIME ref: 00007FFE013C6C4E
DName::DName.LIBVCRUNTIME ref: 00007FFE013C6C7E
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C6C8D
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C6C9C
DName::DName.LIBVCRUNTIME ref: 00007FFE013C6CC0
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFE013C6CF1
DName::doPchar.LIBVCRUNTIME ref: 00007FFE013C6D34
UnDecorator::getDecoratedName.LIBVCRUNTIME ref: 00007FFE013C6D45
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C6D51
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C6D5C
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFE013C6D7E
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C6D8A
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C6D95
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFE013C6D9E
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C6DAA
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C6DB5
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFE013C6DBE
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C6DCA
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C6DD9

Strings

`generic-method-parameter-, xrefs: 00007FFE013C6ED2
`generic-class-parameter-, xrefs: 00007FFE013C6F07
NULL, xrefs: 00007FFE013C6CB6
`template-type-parameter-, xrefs: 00007FFE013C6F10

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: Decorator::get$Name::operator+=$DimensionSigned$Name$Name::operator+$DecoratedName::$DataName::doName::getPcharStringType
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-
API String ID: 283215372-4167119577
Opcode ID: 206bb17a35856a5c12e7a0737586105bcbeb8d34386c92626a515356f002b652
Instruction ID: 2172128197456141c4b7be8956d91bae9c7d7b4b676f87a1acddc58bc5070c4f
Opcode Fuzzy Hash: 206bb17a35856a5c12e7a0737586105bcbeb8d34386c92626a515356f002b652
Instruction Fuzzy Hash: 06B15BA2F0C64388FB109B64D4562FC2762AF45788F964036DA0D1BBB6DF7CE54AD740

Function 00007FFE1A4594B8 Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 382COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A459A29
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A459A5E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A459A97

Strings

__int128, xrefs: 00007FFE1A459750
int, xrefs: 00007FFE1A459564
void, xrefs: 00007FFE1A45961C
decltype(auto), xrefs: 00007FFE1A459900
float, xrefs: 00007FFE1A45960A
auto, xrefs: 00007FFE1A4597EB
const, xrefs: 00007FFE1A459887
volatile, xrefs: 00007FFE1A4598CF
bool, xrefs: 00007FFE1A459780
__w64 , xrefs: 00007FFE1A4596FC
wchar_t, xrefs: 00007FFE1A45994A
<unknown>, xrefs: 00007FFE1A4597CA
unsigned , xrefs: 00007FFE1A4599E6
this , xrefs: 00007FFE1A459971
__int32, xrefs: 00007FFE1A45976E
__int8, xrefs: 00007FFE1A4596D2
char, xrefs: 00007FFE1A459588
char32_t, xrefs: 00007FFE1A4599AB
__int64, xrefs: 00007FFE1A45975F
double, xrefs: 00007FFE1A4595DE
volatile, xrefs: 00007FFE1A4598A2
signed , xrefs: 00007FFE1A4599F6
short, xrefs: 00007FFE1A459576
long , xrefs: 00007FFE1A4595C7
long, xrefs: 00007FFE1A459552
__int16, xrefs: 00007FFE1A4596C0
char16_t, xrefs: 00007FFE1A4597B8
UNKNOWN, xrefs: 00007FFE1A45992C
char8_t, xrefs: 00007FFE1A4597D9

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1482988683
Opcode ID: 9af3000e46094686c92b09a1ab6ba282d3ea35f814097fcec630d6e6c72122d6
Instruction ID: 5c88346a1f5f333869e985466dc0456801a4d5599bf480a8075749a0f3c82d9e
Opcode Fuzzy Hash: 9af3000e46094686c92b09a1ab6ba282d3ea35f814097fcec630d6e6c72122d6
Instruction Fuzzy Hash: 810262B6F18E1288FB14AB66D9501FC27B1BB06B64F5441F7CA0D93ABADF2C9564C340

Function 00007FFE11513D80 Relevance: 58.0, APIs: 19, Strings: 14, Instructions: 244networkCOMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON312 ref: 00007FFE11513DFC
PyErr_Format.PYTHON312 ref: 00007FFE11514102
_Py_Dealloc.PYTHON312 ref: 00007FFE1151415E
htons.WS2_32 ref: 00007FFE1151417B

Strings

%s(): AF_HYPERV address service_id is not a valid UUID string, xrefs: 00007FFE11513EDC
%s(): port must be 0-65535., xrefs: 00007FFE115140ED
%s(): AF_HYPERV address vm_id is not a valid UUID string, xrefs: 00007FFE11513E99
UU;AF_HYPERV address must be a str tuple (vm_id, service_id), xrefs: 00007FFE11513E69
O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]]), xrefs: 00007FFE11513FD8
%s(): AF_INET6 address must be tuple, not %.500s, xrefs: 00007FFE11513FA8
%s(): wrong format, xrefs: 00007FFE11513F55
%s(): bad family, xrefs: 00007FFE11513DD1
%s(): AF_INET address must be tuple, not %.500s, xrefs: 00007FFE115140A5
%s(): unknown Bluetooth protocol, xrefs: 00007FFE11513F20
%s(): flowinfo must be 0-1048575., xrefs: 00007FFE11514051
%s(): AF_HYPERV address must be tuple, not %.500s, xrefs: 00007FFE11513E3A
O&i;AF_INET address must be a pair (host, port), xrefs: 00007FFE115140C8
%s(): unsupported AF_HYPERV protocol: %d, xrefs: 00007FFE11513DEE

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Err_Format$Deallochtons
String ID: %s(): AF_HYPERV address must be tuple, not %.500s$%s(): AF_HYPERV address service_id is not a valid UUID string$%s(): AF_HYPERV address vm_id is not a valid UUID string$%s(): AF_INET address must be tuple, not %.500s$%s(): AF_INET6 address must be tuple, not %.500s$%s(): bad family$%s(): flowinfo must be 0-1048575.$%s(): port must be 0-65535.$%s(): unknown Bluetooth protocol$%s(): unsupported AF_HYPERV protocol: %d$%s(): wrong format$O&i;AF_INET address must be a pair (host, port)$O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]])$UU;AF_HYPERV address must be a str tuple (vm_id, service_id)
API String ID: 2819711985-3631354148
Opcode ID: 8e1881915d7ad1258f229862a5d769ac2d285f5d72e59abb1b34cb8f05b7e779
Instruction ID: 426b544f9bc36422fbe29a7673ee7835e8ad4757915f90736cb3d3277813310a
Opcode Fuzzy Hash: 8e1881915d7ad1258f229862a5d769ac2d285f5d72e59abb1b34cb8f05b7e779
Instruction Fuzzy Hash: F2C13B72A08F4296EB12CF66D8541B937BAFB44BA8F405172DA4D476B4EF3CE545C301

Function 00007FFE013C4A24 Relevance: 48.3, APIs: 32, Instructions: 343COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE013C4A75

Part of subcall function 00007FFE013C1B40: DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C1B5B

DName::DName.LIBVCRUNTIME ref: 00007FFE013C4B2D
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C4B3D
UnDecorator::getScope.LIBVCRUNTIME ref: 00007FFE013C4B60
DName::doPchar.LIBVCRUNTIME ref: 00007FFE013C4B82
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C4B92
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C4BA3
UnDecorator::getDataIndirectType.LIBVCRUNTIME ref: 00007FFE013C4C4A

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+$Decorator::get$DataIndirectNameName::Name::doName::operator+=PcharScopeType
String ID:
API String ID: 3173522582-0
Opcode ID: 02306cc864f4b2e9e10b5f856ee9659bc945c0b58451fc261a502ca0a1775c45
Instruction ID: 1fc0576e57f450e72c2b118c921e8002a3e826a2a025ccab5037427d65d7cc78
Opcode Fuzzy Hash: 02306cc864f4b2e9e10b5f856ee9659bc945c0b58451fc261a502ca0a1775c45
Instruction Fuzzy Hash: 26F15976B08A829AEB11DF64E4901ED37B1FB04788B458036EA4D5BBAADF3CD519C740

Function 00007FFE11515AB0 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 234threadnetworkCOMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FFE11515AF4
PySys_Audit.PYTHON312 ref: 00007FFE11515B2C
PyErr_Format.PYTHON312 ref: 00007FFE11515B84
PySys_Audit.PYTHON312 ref: 00007FFE11515C82
PyEval_SaveThread.PYTHON312 ref: 00007FFE11515C90
WSASocketW.WS2_32 ref: 00007FFE11515CBC
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11515CC8
SetHandleInformation.KERNEL32 ref: 00007FFE11515CE6
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE11515CF2
closesocket.WS2_32 ref: 00007FFE11515CFB
PyLong_AsLongLong.PYTHON312 ref: 00007FFE11515D25
PyErr_Occurred.PYTHON312 ref: 00007FFE11515D34
PyErr_SetString.PYTHON312 ref: 00007FFE11515D54
memset.VCRUNTIME140 ref: 00007FFE11515D74
getsockname.WS2_32 ref: 00007FFE11515D86
WSAGetLastError.WS2_32 ref: 00007FFE11515DA5
getsockopt.WS2_32 ref: 00007FFE11515DE2
PyEval_SaveThread.PYTHON312 ref: 00007FFE11515E23
WSASocketW.WS2_32 ref: 00007FFE11515E44
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11515E50

Strings

socket.__new__, xrefs: 00007FFE11515B25, 00007FFE11515C1D
negative file descriptor, xrefs: 00007FFE11515D4A
socket descriptor string has wrong size, should be %zu bytes., xrefs: 00007FFE11515B74
Oiii, xrefs: 00007FFE11515B13, 00007FFE11515C5D

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Err_Eval_Thread$AuditLongRestoreSaveSocketSys_$ErrorFormatFromHandleInformationLastLong_ModuleOccurredStringType_Windowsclosesocketgetsocknamegetsockoptmemset
String ID: Oiii$negative file descriptor$socket descriptor string has wrong size, should be %zu bytes.$socket.__new__
API String ID: 3363282672-2881308447
Opcode ID: 04267ebc9d147e07de267a693846aa419f582f40a8f4303f6ede1e2826baac7f
Instruction ID: d556367262900d4fa9a952ed718c5e1d2e3a1b9b107c3e29e13bda39948ae3d9
Opcode Fuzzy Hash: 04267ebc9d147e07de267a693846aa419f582f40a8f4303f6ede1e2826baac7f
Instruction Fuzzy Hash: 3FB1A262E18E8182E7218F2AD8042B97365FB99BB8F045375DE5E136B1EF7CE585C700

Function 00007FFE133021F4 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 206timethreadnetworkCOMMON

Download Yara Rule

APIs

_PyTime_FromSecondsObject.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE13302252
PyErr_ExceptionMatches.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE13302266
PyErr_SetString.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE133022B2

Part of subcall function 00007FFE13302568: PySequence_Fast.PYTHON312(00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE13302590

_PyDeadline_Init.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE1330236D
PyEval_SaveThread.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE133023A7
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE133023B0
select.WS2_32(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE133023C9
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE133023D5
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE133023DB
PyErr_CheckSignals.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE133023EA
_PyDeadline_Get.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE13302407
_PyTime_AsTimeval_clamp.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE13302425
PyErr_Occurred.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE13302480
PyTuple_Pack.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE13302497
_Py_Dealloc.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE133024B4
_Py_Dealloc.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE133024CD
_Py_Dealloc.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE133024E6
WSAGetLastError.WS2_32(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE1330254C
PyErr_SetExcFromWindowsErr.PYTHON312(?,?,?,00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE1330255E

Part of subcall function 00007FFE13302568: PyObject_AsFileDescriptor.PYTHON312(?,?,00007FFE133021E3), ref: 00007FFE13302602
Part of subcall function 00007FFE13302568: PyErr_SetString.PYTHON312(?,?,00007FFE133021E3), ref: 00007FFE13302688
Part of subcall function 00007FFE13302568: _Py_Dealloc.PYTHON312(?,?,00007FFE133021E3), ref: 00007FFE1330269C
Part of subcall function 00007FFE13302568: _Py_Dealloc.PYTHON312(?,?,00007FFE133021E3), ref: 00007FFE133026B0

Part of subcall function 00007FFE13302568: _Py_Dealloc.PYTHON312(?,?,00007FFE133021E3), ref: 00007FFE133026CB

Strings

timeout must be a float or None, xrefs: 00007FFE13302277
timeout must be non-negative, xrefs: 00007FFE133022A8

Memory Dump Source

Source File: 00000001.00000002.2938594897.00007FFE13301000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2938578259.00007FFE13300000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938612939.00007FFE13303000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938629391.00007FFE13305000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938646123.00007FFE13306000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_3OQL58yflv.jbxd

Similarity

API ID: DeallocErr_$Deadline_Eval_FromStringThreadTime__errno$CheckDescriptorErrorExceptionFastFileInitLastMatchesObjectObject_OccurredPackRestoreSaveSecondsSequence_SignalsTimeval_clampTuple_Windowsselect
String ID: timeout must be a float or None$timeout must be non-negative
API String ID: 1581318368-2150404077
Opcode ID: 7d38a3b17ebf55bf49675b82177c9a06bc5c3781fec886ab968ba646aff31ed1
Instruction ID: 065c4f3ec4e4ea3d23fe05677bb236957c9b51de219979240fb327d50240b1cb
Opcode Fuzzy Hash: 7d38a3b17ebf55bf49675b82177c9a06bc5c3781fec886ab968ba646aff31ed1
Instruction Fuzzy Hash: A2916031A08E8389EB249F22D8442BE63A4FF64BB4F404171DA6DA7AB8DF3CD545C704

Function 00007FFE1A45CDBC Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CE4D
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CE86
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CF5A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CF6B
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CFCE
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CFDE
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45D02A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45D03C
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45D1B1

Part of subcall function 00007FFE1A45ED94: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A45EDEE

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45D233
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45D242

Strings

`anonymous namespace', xrefs: 00007FFE1A45D10E

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID: `anonymous namespace'
API String ID: 3863519203-3062148218
Opcode ID: c2c563be3abc2cd025459880134dd91d33137c93c5547e13454a58e5101b2a40
Instruction ID: b0aecc6a5b2ee625eb65b6c04eb6cd1c2b65b4eb29808fc0c3c241776bc2e4aa
Opcode Fuzzy Hash: c2c563be3abc2cd025459880134dd91d33137c93c5547e13454a58e5101b2a40
Instruction Fuzzy Hash: A2E16DB2B08F8299EB10EF26D8801BD77A0FB45B58F4081B6EA8D17B65DF38D565C700

Function 00007FFE11EA7184 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 156threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FFE11EA71AB
PyThread_allocate_lock.PYTHON312 ref: 00007FFE11EA721E
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11EA725E
_Py_Dealloc.PYTHON312 ref: 00007FFE11EA72FF
PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE11EA731D
PyErr_Occurred.PYTHON312 ref: 00007FFE11EA7326
PyErr_SetString.PYTHON312 ref: 00007FFE11EA7374
_Py_Dealloc.PYTHON312 ref: 00007FFE11EB48BB
_Py_Dealloc.PYTHON312 ref: 00007FFE11EB48EC

Strings

Cannot specify filters except with FORMAT_RAW, xrefs: 00007FFE11EA7363
Unable to allocate lock, xrefs: 00007FFE11EB48C8
Must specify filters for FORMAT_RAW, xrefs: 00007FFE11EB48A2
Invalid container format: %d, xrefs: 00007FFE11EB48FF
Cannot specify memory limit with FORMAT_RAW, xrefs: 00007FFE11EA7381

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Dealloc$Err_LongString$Bytes_FromLong_ModuleOccurredSizeStateThread_allocate_lockType_Unsigned
String ID: Cannot specify filters except with FORMAT_RAW$Cannot specify memory limit with FORMAT_RAW$Invalid container format: %d$Must specify filters for FORMAT_RAW$Unable to allocate lock
API String ID: 553332449-1518367256
Opcode ID: 1867860c6624fab58e7be931ed0897b3e3b5a7b60a45140879a5590b013d8165
Instruction ID: c43085ef694ae5c51b8e02bac71d0bb88b9a427eaca29d8b937fe00a89ef95f8
Opcode Fuzzy Hash: 1867860c6624fab58e7be931ed0897b3e3b5a7b60a45140879a5590b013d8165
Instruction Fuzzy Hash: D1614621E08E4289EB64CFA7AC1467B63A8BF45FB4F0841B6DD0E063B4DF3DA4448314

Function 00007FFE11EB00E8 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PyMapping_GetItemString.PYTHON312 ref: 00007FFE11EB0111
PyMem_Calloc.PYTHON312 ref: 00007FFE11EB0168
_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE11EB024E
PyErr_ExceptionMatches.PYTHON312 ref: 00007FFE11EB0278
PyErr_Clear.PYTHON312 ref: 00007FFE11EB0282

Part of subcall function 00007FFE11EB12DC: PyLong_AsUnsignedLongLong.PYTHON312(?,?,00000006,00007FFE11EB0138), ref: 00007FFE11EB12E9
Part of subcall function 00007FFE11EB12DC: PyErr_Occurred.PYTHON312(?,?,00000006,00007FFE11EB0138), ref: 00007FFE11EB12F2

PyErr_SetString.PYTHON312 ref: 00007FFE11EB029E
PyMem_Free.PYTHON312 ref: 00007FFE11EB02A7
_Py_Dealloc.PYTHON312 ref: 00007FFE11EB58CE

Strings

Invalid filter specifier for LZMA filter, xrefs: 00007FFE11EB0294
|OOO&O&O&O&O&O&O&O&, xrefs: 00007FFE11EB01FB
preset, xrefs: 00007FFE11EB0104
Invalid compression preset: %u, xrefs: 00007FFE11EB58F3

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Err_$LongMem_String$Arg_CallocClearDeallocExceptionFreeItemKeywords_Long_Mapping_MatchesOccurredParseSizeTupleUnsigned
String ID: Invalid compression preset: %u$Invalid filter specifier for LZMA filter$preset$|OOO&O&O&O&O&O&O&O&
API String ID: 1879153319-1461672608
Opcode ID: 8417e614f1d500f67b7fc05ef083ba9e0f1382ea6e810784a925ecbbc0dd8382
Instruction ID: 018bb7f7122afa944da88c255f4deccbe6c92f14fa315e9dbf52682e3ad09221
Opcode Fuzzy Hash: 8417e614f1d500f67b7fc05ef083ba9e0f1382ea6e810784a925ecbbc0dd8382
Instruction Fuzzy Hash: 2F51E836A09F4295EB208F92FC406AA77A8FB88BA0F544176CA8D43775DF3CE459C744

Function 00007FFE11518194 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE115181C1
PyErr_SetString.PYTHON312 ref: 00007FFE115181ED
PyBuffer_Release.PYTHON312 ref: 00007FFE115181F8
PyErr_SetString.PYTHON312 ref: 00007FFE11518227
PyBuffer_Release.PYTHON312 ref: 00007FFE11518232
inet_ntop.WS2_32 ref: 00007FFE11518259
PyErr_SetFromErrno.PYTHON312 ref: 00007FFE11518271
PyBuffer_Release.PYTHON312 ref: 00007FFE1151827C
PyBuffer_Release.PYTHON312 ref: 00007FFE115182A9
PyUnicode_FromString.PYTHON312 ref: 00007FFE115182B2
PyErr_Format.PYTHON312 ref: 00007FFE115182CE
PyBuffer_Release.PYTHON312 ref: 00007FFE115182D9

Strings

invalid length of packed IP address string, xrefs: 00007FFE115181E3, 00007FFE1151821D
unknown address family %d, xrefs: 00007FFE115182C1
iy*:inet_ntop, xrefs: 00007FFE115181B5

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Buffer_Release$Err_$String$From$Arg_ErrnoFormatParseSizeTuple_Unicode_inet_ntop
String ID: invalid length of packed IP address string$iy*:inet_ntop$unknown address family %d
API String ID: 1507301079-2822559286
Opcode ID: da31bfa32fa8dceb5393cac8a68f2152996136d61796e77c4bbc28237e009f20
Instruction ID: a3d0d79a4c56aecef176ef9ad4a0144346ef76cb7b9bf8d14a5b928132454229
Opcode Fuzzy Hash: da31bfa32fa8dceb5393cac8a68f2152996136d61796e77c4bbc28237e009f20
Instruction Fuzzy Hash: F1310D61A58D8381FB628B26E8906F923BAFF88B64F401472D54F87674EF6CE449C701

Function 00007FFE013C7738 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 195COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getTemplateName.LIBVCRUNTIME ref: 00007FFE013C77B8
Replicator::operator+=.LIBVCRUNTIME ref: 00007FFE013C79DB

Strings

template-parameter-, xrefs: 00007FFE013C7815
generic-type-, xrefs: 00007FFE013C7851

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: Decorator::getNameReplicator::operator+=Template
String ID: generic-type-$template-parameter-
API String ID: 2731555906-13229604
Opcode ID: 807daf277988afa25981cc5e3adf780ae8c5a9f6f43c8f2aa980fa52882d43c7
Instruction ID: 2b4b6c04ad3a8c30da8700da579966a7c8fb396445787ae9c2fe7721524b61e2
Opcode Fuzzy Hash: 807daf277988afa25981cc5e3adf780ae8c5a9f6f43c8f2aa980fa52882d43c7
Instruction Fuzzy Hash: 23919A62A19B8689FB11CB64D8506FD3BB1AB45B88F821032DE4D5B7B6DF3CE505D700

Function 00007FFE11515144 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114networkthreadCOMMON

Download Yara Rule

APIs

_PyDeadline_Get.PYTHON312 ref: 00007FFE11515198
_PyDeadline_Init.PYTHON312 ref: 00007FFE115151C0
WSAGetLastError.WS2_32 ref: 00007FFE115151EB
WSAGetLastError.WS2_32 ref: 00007FFE115151F3
PyErr_CheckSignals.PYTHON312 ref: 00007FFE11515204
PyEval_SaveThread.PYTHON312 ref: 00007FFE1151522F
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11515249
WSAGetLastError.WS2_32 ref: 00007FFE11515258
WSAGetLastError.WS2_32 ref: 00007FFE11515260
PyErr_CheckSignals.PYTHON312 ref: 00007FFE1151526D

Part of subcall function 00007FFE1151454C: _PyTime_AsTimeval_clamp.PYTHON312 ref: 00007FFE115145A1
Part of subcall function 00007FFE1151454C: PyEval_SaveThread.PYTHON312 ref: 00007FFE115145E0
Part of subcall function 00007FFE1151454C: select.WS2_32 ref: 00007FFE11514614
Part of subcall function 00007FFE1151454C: PyEval_RestoreThread.PYTHON312 ref: 00007FFE1151461F

WSAGetLastError.WS2_32 ref: 00007FFE11515280
WSAGetLastError.WS2_32 ref: 00007FFE11515295
PyErr_SetString.PYTHON312 ref: 00007FFE115152D1

Strings

timed out, xrefs: 00007FFE115152C7

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$Eval_Thread$Err_$CheckDeadline_RestoreSaveSignals$InitStringTime_Timeval_clampselect
String ID: timed out
API String ID: 497267021-3163636755
Opcode ID: 8048b4ae316fdf912cb11b0f3ce4ab9d7ecbb7bf006f07ec21ad1d61a967340c
Instruction ID: 7b7aaddb26bc0ea62c8c62c1a903cbc4841165b27fcf1085146228ebec22487f
Opcode Fuzzy Hash: 8048b4ae316fdf912cb11b0f3ce4ab9d7ecbb7bf006f07ec21ad1d61a967340c
Instruction Fuzzy Hash: C2419436E18E4381F7275B63A4442B962AABF46B78F1C01B0DD6E427B4DF3CE8858601

Function 00007FFE11516C48 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE11516C78
setsockopt.WS2_32 ref: 00007FFE11516CA2
PyErr_Clear.PYTHON312 ref: 00007FFE11516CAF
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE11516CF3
PyErr_Clear.PYTHON312 ref: 00007FFE11516D0A
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE11516D34
PyBuffer_Release.PYTHON312 ref: 00007FFE11516D50
PyErr_Format.PYTHON312 ref: 00007FFE11516D6D
setsockopt.WS2_32 ref: 00007FFE11516D93
PyBuffer_Release.PYTHON312 ref: 00007FFE11516DA0

Strings

iiO!I:setsockopt, xrefs: 00007FFE11516CCC
iii:setsockopt, xrefs: 00007FFE11516C71
socket option is larger than %i bytes, xrefs: 00007FFE11516D5D
iiy*:setsockopt, xrefs: 00007FFE11516D2D

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Arg_Err_ParseSizeTuple_$Buffer_ClearReleasesetsockopt$Format
String ID: iiO!I:setsockopt$iii:setsockopt$iiy*:setsockopt$socket option is larger than %i bytes
API String ID: 418579395-1608436615
Opcode ID: 00bb59efab9f7172e8937e6f66c8eab6ad29b02b98a3246fc78355982980a26d
Instruction ID: 753bad5d558dd3fe792ad9c25f913c158979d38df1b37f3bba43b820d6127730
Opcode Fuzzy Hash: 00bb59efab9f7172e8937e6f66c8eab6ad29b02b98a3246fc78355982980a26d
Instruction Fuzzy Hash: 9A410A32608E8692EB218F22E4446A9737AFB89BA4F500171DA9D43B74EF7CD548C741

Function 00007FFE115129A0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON312 ref: 00007FFE115129BC
GetComputerNameExW.KERNEL32 ref: 00007FFE115129DD
PyUnicode_FromWideChar.PYTHON312 ref: 00007FFE115129F4
GetLastError.KERNEL32 ref: 00007FFE11513A1C
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE11513A2B

Strings

socket.gethostname, xrefs: 00007FFE115129B5

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: From$AuditCharComputerErr_ErrorLastNameSys_Unicode_WideWindows
String ID: socket.gethostname
API String ID: 1075394898-2650736202
Opcode ID: 3405576d76487752179143ca9e9ce24f0a64481455d61518cebafc033de9272a
Instruction ID: 3765824de3d318c62012cb520c32c43a16fc57bd29e2ac15a2fb7fccf570cd03
Opcode Fuzzy Hash: 3405576d76487752179143ca9e9ce24f0a64481455d61518cebafc033de9272a
Instruction Fuzzy Hash: 64314121B0CF4282E7669B27A81427A63BBFF88BB5F5404B5D94E426B4EF7CE544C600

Function 00007FFE11517E54 Relevance: 24.1, APIs: 16, Instructions: 106COMMON

Download Yara Rule

APIs

PyList_New.PYTHON312 ref: 00007FFE11517E71
GetIfTable2Ex.IPHLPAPI ref: 00007FFE11517E95
_Py_Dealloc.PYTHON312 ref: 00007FFE11517EAF
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE11517EB7
memcpy.VCRUNTIME140 ref: 00007FFE11517EF5
ConvertInterfaceLuidToNameW.IPHLPAPI ref: 00007FFE11517F0D
_Py_BuildValue_SizeT.PYTHON312 ref: 00007FFE11517F30
PyList_Append.PYTHON312 ref: 00007FFE11517F44
_Py_Dealloc.PYTHON312 ref: 00007FFE11517F5E
FreeMibTable.IPHLPAPI ref: 00007FFE11517F77
_Py_Dealloc.PYTHON312 ref: 00007FFE11517FB6
_Py_Dealloc.PYTHON312 ref: 00007FFE11517FCA
FreeMibTable.IPHLPAPI ref: 00007FFE11517FD5
_Py_Dealloc.PYTHON312 ref: 00007FFE11517FED
FreeMibTable.IPHLPAPI ref: 00007FFE11517FF8
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FFE11518000

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Dealloc$FreeTable$Err_FromList_Windows$AppendBuildConvertInterfaceLuidNameSizeTable2Value_memcpy
String ID:
API String ID: 1684791173-0
Opcode ID: 75ac4720bd9ac20c8a6dca0399f09d24f262417c30787c0c26002b61ab87c140
Instruction ID: 0a4a299a714feaa00123630e91d64afefed7020770c97de0085e6669f9917e90
Opcode Fuzzy Hash: 75ac4720bd9ac20c8a6dca0399f09d24f262417c30787c0c26002b61ab87c140
Instruction Fuzzy Hash: 69418332E0CF4282EB669B26E85437A73AAFF84B65F040075D95E426B4EF3CE544CB01

Function 00007FFE1A45DC24 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFE1A4590F4), ref: 00007FFE1A45E08A
DName::DName.LIBVCRUNTIME ref: 00007FFE1A45E0C9
swprintf_s.PGOCR ref: 00007FFE1A45E0E9
DName::DName.LIBVCRUNTIME ref: 00007FFE1A45E0F9
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45E149

Strings

lambda, xrefs: 00007FFE1A45DFE8
`template-type-parameter-, xrefs: 00007FFE1A45E16A
`generic-method-parameter-, xrefs: 00007FFE1A45E116
`generic-class-parameter-, xrefs: 00007FFE1A45E15A
nullptr, xrefs: 00007FFE1A45DE0D
NULL, xrefs: 00007FFE1A45DCF1

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: NameName::$Name::operator+atolswprintf_s
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 2331677841-2441609178
Opcode ID: 04052d8e5626c1f24672c52f4d573e3506f88365006a7f318b5907256fbad706
Instruction ID: 93562e20a7cb230eb50f8f01d2e8e48d429b6c114f72410326a843cfe3031cc9
Opcode Fuzzy Hash: 04052d8e5626c1f24672c52f4d573e3506f88365006a7f318b5907256fbad706
Instruction Fuzzy Hash: 3FF1AEE2F08E1284FB25FB66D5551BC27A1AF45F64F4040F7CA4E16AB6DF3CA5698300

Function 00007FFE130C1D48 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE130C19A4: DloadProtectSection.DELAYIMP ref: 00007FFE130C1A15

RaiseException.KERNEL32 ref: 00007FFE130C1DEF
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFE130C1DDB

Part of subcall function 00007FFE130C1CB4: DloadProtectSection.DELAYIMP ref: 00007FFE130C1D13

LoadLibraryExA.KERNEL32 ref: 00007FFE130C1E8E
GetLastError.KERNEL32 ref: 00007FFE130C1E9C
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FFE130C1ECE
RaiseException.KERNEL32 ref: 00007FFE130C1EE2

Strings

H, xrefs: 00007FFE130C1DBC

Memory Dump Source

Source File: 00000001.00000002.2938510031.00007FFE130C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2938494029.00007FFE130C0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938526688.00007FFE130C4000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938542624.00007FFE130C6000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938561193.00007FFE130C7000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_3OQL58yflv.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: 0e071de0604d183fb0644e7ce77b347e1e2f363c91ec37c3347462e594843c1b
Instruction ID: 26971ccebfa14ccaa8eab468a57a9ac30178ef6ab99c672eb68b654152bd082c
Opcode Fuzzy Hash: 0e071de0604d183fb0644e7ce77b347e1e2f363c91ec37c3347462e594843c1b
Instruction Fuzzy Hash: AA914B32A15F128AEB05CF66D8406A833F2FB28768F8545B5DE0D27B65EF78E445C300

Function 00007FFE11EA7F84 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE11EA7FD9
PyObject_GetBuffer.PYTHON312 ref: 00007FFE11EA800D
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE11EA801E
PyBuffer_Release.PYTHON312 ref: 00007FFE11EA8051
_PyNumber_Index.PYTHON312 ref: 00007FFE11EA8083
PyLong_AsSsize_t.PYTHON312 ref: 00007FFE11EA8094
_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE11EA80EF
PyErr_Occurred.PYTHON312 ref: 00007FFE11EA810F
_PyArg_BadArgument.PYTHON312 ref: 00007FFE11EB4A5E

Strings

decompress, xrefs: 00007FFE11EB4A57
contiguous buffer, xrefs: 00007FFE11EB4A49
argument 'data', xrefs: 00007FFE11EB4A50

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Arg_Buffer_$ArgumentBufferContiguousErr_IndexKeywordsLong_Number_Object_OccurredReleaseSsize_tUnpackmemset
String ID: argument 'data'$contiguous buffer$decompress
API String ID: 883004049-2667845042
Opcode ID: a0ceb6e80e3e7280ac3f19f8773f4dcbf3ce71477609682742b3c7844e3c9f11
Instruction ID: 5bc95c2f0d3a77b0c959c083f4d5fea606ed0adc7e73a68753030e638c12f784
Opcode Fuzzy Hash: a0ceb6e80e3e7280ac3f19f8773f4dcbf3ce71477609682742b3c7844e3c9f11
Instruction Fuzzy Hash: 8F416D31A49F4286EB108B93EC84A7A63A8FB59BA1F444172DE5D137B4EF3CE545C700

Function 00007FFE11515E90 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 113networkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE11515ED2
PyErr_Format.PYTHON312 ref: 00007FFE11515F14
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE11515F4F
WSAIoctl.WS2_32 ref: 00007FFE11515F86
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE11515FBA
WSAIoctl.WS2_32 ref: 00007FFE11515FF5
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE11516003
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE11516027
WSAIoctl.WS2_32 ref: 00007FFE11516062

Strings

kI:ioctl, xrefs: 00007FFE11515F48, 00007FFE11516020
kO:ioctl, xrefs: 00007FFE11515ECB
k(kkk):ioctl, xrefs: 00007FFE11515FB3
invalid ioctl command %lu, xrefs: 00007FFE11515F0A

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Arg_ParseSizeTuple_$Ioctl$Err_FormatFromLongLong_Unsigned
String ID: invalid ioctl command %lu$k(kkk):ioctl$kI:ioctl$kO:ioctl
API String ID: 1148432870-4238462244
Opcode ID: 281e550bce6c78bd7668c016f160d04607797c634319134c59071ece2302defe
Instruction ID: 53ab78e10ef595d6903633784c73c93a85c51f50159533fd549c102319d18386
Opcode Fuzzy Hash: 281e550bce6c78bd7668c016f160d04607797c634319134c59071ece2302defe
Instruction Fuzzy Hash: E7519F72A28E0289E751CF66E8405ED33B9FB48768F544172EA5E93A78EF3CD544CB40

Function 00007FFE11514230 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

PyBytes_AsString.PYTHON312 ref: 00007FFE1151426F
PyBytes_Size.PYTHON312 ref: 00007FFE1151427C
PyErr_SetString.PYTHON312 ref: 00007FFE1151431E
_Py_Dealloc.PYTHON312 ref: 00007FFE115143A5

Strings

encoding of hostname failed, xrefs: 00007FFE1151430D
host name must not contain null character, xrefs: 00007FFE115143AB
idna, xrefs: 00007FFE115142F5
str, bytes or bytearray expected, not %s, xrefs: 00007FFE11514343

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Bytes_String$DeallocErr_Size
String ID: encoding of hostname failed$host name must not contain null character$idna$str, bytes or bytearray expected, not %s
API String ID: 2522550923-2120988924
Opcode ID: 7e83059e8b44ae695e1944d6d4c487bf6ffb85ae8c0ab70a37bc135e2c9e2e91
Instruction ID: ff202637f90ebee442f13f965fa6eeb45b794d3104d806cceb4f7f30ef4e9040
Opcode Fuzzy Hash: 7e83059e8b44ae695e1944d6d4c487bf6ffb85ae8c0ab70a37bc135e2c9e2e91
Instruction Fuzzy Hash: 59414C66A09F4281EB5A8F57E89437827AAAF45BA4F546575CA2E473B0DF3CE4D0C300

Function 00007FFE11EB0570 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 143threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FFE11EB05B6
_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE11EB05F7
PyThread_allocate_lock.PYTHON312 ref: 00007FFE11EB065E
PyErr_Format.PYTHON312 ref: 00007FFE11EB06E6
_Py_Dealloc.PYTHON312 ref: 00007FFE11EB06F9
PyErr_SetString.PYTHON312 ref: 00007FFE11EB0779
_Py_Dealloc.PYTHON312 ref: 00007FFE11EB599D

Strings

Unable to allocate lock, xrefs: 00007FFE11EB59AA
Integrity checks are only supported by FORMAT_XZ, xrefs: 00007FFE11EB5984
Invalid container format: %d, xrefs: 00007FFE11EB06DC
|iiOO:LZMACompressor, xrefs: 00007FFE11EB05C9
Cannot specify both preset and filter chain, xrefs: 00007FFE11EB0768

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: DeallocErr_$Arg_FormatKeywords_ModuleParseSizeStateStringThread_allocate_lockTupleType_
String ID: Cannot specify both preset and filter chain$Integrity checks are only supported by FORMAT_XZ$Invalid container format: %d$Unable to allocate lock$|iiOO:LZMACompressor
API String ID: 1600877341-3984722346
Opcode ID: 77ffa3b08e542e0f60acbba16875cd9370a5d4c1432a4bb831e8e8e7c99ccac2
Instruction ID: f99da657192a5eddc1d7eabe3b2728623e422f765339f71fb7337e1185b59909
Opcode Fuzzy Hash: 77ffa3b08e542e0f60acbba16875cd9370a5d4c1432a4bb831e8e8e7c99ccac2
Instruction Fuzzy Hash: C3612832A09F1289EB109FA6EC404AA37B8FB48BA8F544573DA4D43B68DF3CE545C744

Function 00007FFE1A45B280 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45B2D1
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45B39A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45B3E3
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45B3F4

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 9a3856515ab70ac0cbef49cb78169d28014df4ca819d0bec0dbbb0bc7461e156
Instruction ID: 2e7bae8358ff074180c73b1976c0d414eba33ed367bfbf5dccadc2b75fdc8e4b
Opcode Fuzzy Hash: 9a3856515ab70ac0cbef49cb78169d28014df4ca819d0bec0dbbb0bc7461e156
Instruction Fuzzy Hash: 62F1AEB6B08A829EF711EF66D4501FC37B0EB04B5CB4044B3EA4D57AA9EE38D566C740

Function 00007FFE11EAFF98 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

PyMapping_Check.PYTHON312(?,?,?,00000028,00007FFE11EAFF1F,?,00000000,00007FFE11EAFE54), ref: 00007FFE11EAFFBD
PyMapping_GetItemString.PYTHON312(?,?,?,00000028,00007FFE11EAFF1F,?,00000000,00007FFE11EAFE54), ref: 00007FFE11EAFFD7
PyLong_AsUnsignedLongLong.PYTHON312(?,?,?,00000028,00007FFE11EAFF1F,?,00000000,00007FFE11EAFE54), ref: 00007FFE11EAFFEC
PyErr_Occurred.PYTHON312(?,?,?,00000028,00007FFE11EAFF1F,?,00000000,00007FFE11EAFE54), ref: 00007FFE11EB0003
PyErr_ExceptionMatches.PYTHON312(?,?,?,00000028,00007FFE11EAFF1F,?,00000000,00007FFE11EAFE54), ref: 00007FFE11EB007C
PyErr_Format.PYTHON312(?,?,?,00000028,00007FFE11EAFF1F,?,00000000,00007FFE11EAFE54), ref: 00007FFE11EB00C5
PyErr_SetString.PYTHON312(?,?,?,00000028,00007FFE11EAFF1F,?,00000000,00007FFE11EAFE54), ref: 00007FFE11EB00DE
_Py_Dealloc.PYTHON312(?,?,?,00000028,00007FFE11EAFF1F,?,00000000,00007FFE11EAFE54), ref: 00007FFE11EB58C2

Strings

Filter specifier must be a dict or dict-like object, xrefs: 00007FFE11EB58B3
Invalid filter ID: %llu, xrefs: 00007FFE11EB00B8
Filter specifier must have an "id" entry, xrefs: 00007FFE11EB00D4

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Err_$LongMapping_String$CheckDeallocExceptionFormatItemLong_MatchesOccurredUnsigned
String ID: Filter specifier must be a dict or dict-like object$Filter specifier must have an "id" entry$Invalid filter ID: %llu
API String ID: 1881886752-3390802605
Opcode ID: 1fa081fbd10db4a062d822dc1773f53400f0e4c773b14382a27f01c264c0f77b
Instruction ID: d32d9cc777639830acf133062f100862dbb71592bedffbdd1a3463a683d6b282
Opcode Fuzzy Hash: 1fa081fbd10db4a062d822dc1773f53400f0e4c773b14382a27f01c264c0f77b
Instruction Fuzzy Hash: 2941DE31A09E4389EB658F97AC9453B67B8BF45BA0F4444B7CA8E46770DE3CF4858309

Function 00007FFE11EAFA9C Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE11EAFACD
PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE11EAFAE2
PyErr_Occurred.PYTHON312 ref: 00007FFE11EAFAEB
PyObject_GetBuffer.PYTHON312 ref: 00007FFE11EAFB02
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE11EAFB13
PyBuffer_Release.PYTHON312 ref: 00007FFE11EAFB41
_PyArg_CheckPositional.PYTHON312 ref: 00007FFE11EB5773
_PyArg_BadArgument.PYTHON312 ref: 00007FFE11EB579F

Part of subcall function 00007FFE11EAFB60: PyModule_GetState.PYTHON312(?,?,?,?,?,00007FFE11EAFB31), ref: 00007FFE11EAFB72
Part of subcall function 00007FFE11EAFB60: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFE11EAFB31), ref: 00007FFE11EAFBAE

Strings

contiguous buffer, xrefs: 00007FFE11EB578A
argument 2, xrefs: 00007FFE11EB5791
_decode_filter_properties, xrefs: 00007FFE11EB5769, 00007FFE11EB5798

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Arg_Buffer_Long$ArgumentBufferCheckContiguousErr_Long_Module_Object_OccurredPositionalReleaseStateUnsignedfreememset
String ID: _decode_filter_properties$argument 2$contiguous buffer
API String ID: 3656606796-2431706548
Opcode ID: c0f874db1016260c34f7af794fc4f78e7b75be8506e7dd097bbed22573c2313e
Instruction ID: 3f1e3445daa4bf5b3626d5275884ad89851285ac2103c9a7651753bfc75f1970
Opcode Fuzzy Hash: c0f874db1016260c34f7af794fc4f78e7b75be8506e7dd097bbed22573c2313e
Instruction Fuzzy Hash: 23314F21B08E46D5EB109BA3EC446AA6368FF54F94F9441B2DA4D437B4DF3CE946C704

Function 00007FFE11EA844C Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 60COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE11EA849B
PyErr_NoMemory.PYTHON312 ref: 00007FFE11EB4B38

Strings

Insufficient buffer space, xrefs: 00007FFE11EA84E8
Invalid or unsupported options, xrefs: 00007FFE11EA84D6
Unsupported integrity check, xrefs: 00007FFE11EB4B44
Unrecognized error from liblzma: %d, xrefs: 00007FFE11EB4B57
Input format not supported by decoder, xrefs: 00007FFE11EA8490
Corrupt input data, xrefs: 00007FFE11EA84DF
Internal error, xrefs: 00007FFE11EA84C0
Memory usage limit exceeded, xrefs: 00007FFE11EA84C9

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Err_$MemoryString
String ID: Corrupt input data$Input format not supported by decoder$Insufficient buffer space$Internal error$Invalid or unsupported options$Memory usage limit exceeded$Unrecognized error from liblzma: %d$Unsupported integrity check
API String ID: 60457842-2177155514
Opcode ID: cf3915f93a9f2c2bfbd7f01ec892f8c13fb2e26f54dd94fa10a89e65e2c2ae57
Instruction ID: 0d206c38bdecd7b7f02833daef1ae4838f11590057f884f8be90cb33994651db
Opcode Fuzzy Hash: cf3915f93a9f2c2bfbd7f01ec892f8c13fb2e26f54dd94fa10a89e65e2c2ae57
Instruction Fuzzy Hash: CB210C31E1CE2395EBB887DBAD6487B166CBF41772FA450FAC50E056B49E2DF9448304

Function 00007FFE11517B54 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 44threadnetworkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE11517B75
PySys_Audit.PYTHON312 ref: 00007FFE11517B9B
PyEval_SaveThread.PYTHON312 ref: 00007FFE11517BAF
getservbyname.WS2_32 ref: 00007FFE11517BC2
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11517BCE
PyErr_SetString.PYTHON312 ref: 00007FFE11517BEF
htons.WS2_32 ref: 00007FFE11517C05
PyLong_FromLong.PYTHON312 ref: 00007FFE11517C0E

Strings

socket.getservbyname, xrefs: 00007FFE11517B94
s|s:getservbyname, xrefs: 00007FFE11517B64
service/proto not found, xrefs: 00007FFE11517BE5

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Eval_Thread$Arg_AuditErr_FromLongLong_ParseRestoreSaveSizeStringSys_Tuple_getservbynamehtons
String ID: service/proto not found$socket.getservbyname$s|s:getservbyname
API String ID: 1135235387-1257235949
Opcode ID: f630d60e7c6cc646122b2ca1b708a50a84b5ac44005cd5b452673061408953bf
Instruction ID: 822359e4ece13f94a264f894e8618301e9a0c745e7571e610c283fcfd7a80783
Opcode Fuzzy Hash: f630d60e7c6cc646122b2ca1b708a50a84b5ac44005cd5b452673061408953bf
Instruction Fuzzy Hash: 0F111F65A08E4382EB029B17E8442B9737AFF85BA5F540075DA4E47674EF3DE445C700

Function 00007FFE1A453334 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 309COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFE1A453390

Part of subcall function 00007FFE1A455768: __GetUnwindTryBlock.LIBCMT ref: 00007FFE1A4557AB
Part of subcall function 00007FFE1A455768: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFE1A4557D0

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE1A453468
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A453475
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFE1A4536B9
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4536E7

Part of subcall function 00007FFE1A456E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4529EE), ref: 00007FFE1A456E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4537AD
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1A4537E2

Strings

csm, xrefs: 00007FFE1A4533AA
csm, xrefs: 00007FFE1A45348D
csm, xrefs: 00007FFE1A453411

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: BlockFrameHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 4223619315-393685449
Opcode ID: dcb3548c504605ccad87c1df068e82445ce8bfed626f824eb2c4e809fdb80efd
Instruction ID: e48452420167fd4016481dcbd2d7482d51d7b7028674ea83e554c8d18ca61680
Opcode Fuzzy Hash: dcb3548c504605ccad87c1df068e82445ce8bfed626f824eb2c4e809fdb80efd
Instruction Fuzzy Hash: FFD1B3B2B08B4186EB60AF66D4502BD77A0FB45FA8F1041B6EE4D57B65DF38E1A0C700

Function 00007FFE1A45ED94 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A45EDEE

Strings

template-parameter-, xrefs: 00007FFE1A45EE50
`template-parameter-, xrefs: 00007FFE1A45EE83
`generic-type-, xrefs: 00007FFE1A45EECA
generic-type-, xrefs: 00007FFE1A45EE97

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Replicator::operator[]
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 3676697650-3207858774
Opcode ID: 73310b6c18e80224c33410df5d9c8b136be81ee7f088e8962b8740eac16092a6
Instruction ID: b5c5640df7dcb937c0033f08ff8f980e5b36e6882d1b4293bf9711aad441de39
Opcode Fuzzy Hash: 73310b6c18e80224c33410df5d9c8b136be81ee7f088e8962b8740eac16092a6
Instruction Fuzzy Hash: A591AEA2B18E8699FB21EF22D4512B833B1AB54F68F4481F3DA5D036A5DF3CE565C340

Function 00007FFE11515804 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE11515838
getsockopt.WS2_32 ref: 00007FFE11515873
PyLong_FromLong.PYTHON312 ref: 00007FFE11515881
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE1151589B
getsockopt.WS2_32 ref: 00007FFE115158C6
_Py_Dealloc.PYTHON312 ref: 00007FFE115158E0
_PyBytes_Resize.PYTHON312 ref: 00007FFE115158F5

Strings

getsockopt buflen out of range, xrefs: 00007FFE11515909
ii|i:getsockopt, xrefs: 00007FFE11515824

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Bytes_FromSizegetsockopt$Arg_DeallocLongLong_ParseResizeStringTuple_
String ID: getsockopt buflen out of range$ii|i:getsockopt
API String ID: 3532181676-2750947780
Opcode ID: eb7920220ad90dff871de4a1b8073711b22e927aaec72bd8098bb99a282aa305
Instruction ID: d36b6c00d3264d38d07457cee503728578b0ae61a8ecf607270ea2f8eb9cb9b8
Opcode Fuzzy Hash: eb7920220ad90dff871de4a1b8073711b22e927aaec72bd8098bb99a282aa305
Instruction Fuzzy Hash: 53310C72A2CE42C2EB15CF26E48416973BAFB85B68F141175EA8E43A74DF3CD545CB00

Function 00007FFE115162A8 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE115162F3
PyBuffer_Release.PYTHON312 ref: 00007FFE1151630C
PyErr_SetString.PYTHON312 ref: 00007FFE11516323
PyBuffer_Release.PYTHON312 ref: 00007FFE1151635B
PyBuffer_Release.PYTHON312 ref: 00007FFE1151636F
PyBuffer_Release.PYTHON312 ref: 00007FFE1151637E
PyLong_FromSsize_t.PYTHON312 ref: 00007FFE11516387

Strings

negative buffersize in recv_into, xrefs: 00007FFE11516312
buffer too small for requested bytes, xrefs: 00007FFE11516375
w*|ni:recv_into, xrefs: 00007FFE115162C6

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Buffer_Release$Arg_Err_FromKeywords_Long_ParseSizeSsize_tStringTuple
String ID: buffer too small for requested bytes$negative buffersize in recv_into$w*|ni:recv_into
API String ID: 1544103690-1758107600
Opcode ID: f9c53227e6fdaa7fa629d187077d1b4d95545b4efaaa5b6c412b68bcaee48326
Instruction ID: 7bbaa648b3c28d2f711c034fb22768b4bf9e535fd7698211c3d189423f6e1842
Opcode Fuzzy Hash: f9c53227e6fdaa7fa629d187077d1b4d95545b4efaaa5b6c412b68bcaee48326
Instruction Fuzzy Hash: 38214875A08F4281EB128B53E4442B9637ABB98BA0F40007AC94E837B0EFBCE548C711

Function 00007FFE10231030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE10231058
__scrt_initialize_crt.LIBCMT ref: 00007FFE1023109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE102310AA
_RTC_Initialize.LIBCMT ref: 00007FFE102310D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE102310FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFE10231129

Memory Dump Source

Source File: 00000001.00000002.2937462956.00007FFE10231000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFE10230000, based on PE: true

Associated: 00000001.00000002.2937447788.00007FFE10230000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2937477787.00007FFE10235000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2937492187.00007FFE10236000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2937505821.00007FFE10237000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10230000_3OQL58yflv.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: f971a88d3ae81d83572a64a31c4b34b717c22cee03bf39ed2423e9f1d9f776a2
Instruction ID: ef32ae52d0087a034c0314319dc321cd43fd6c7f5656d6a8d262e3b69c5a6ceb
Opcode Fuzzy Hash: f971a88d3ae81d83572a64a31c4b34b717c22cee03bf39ed2423e9f1d9f776a2
Instruction Fuzzy Hash: 8C81BD20E1CE434EF6549B6794412B92AB4AFCDBA0F6484B5DB4D4F7B7DE2CE441CA00

Function 00007FFE11EB3360 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE11EB3388
__scrt_initialize_crt.LIBCMT ref: 00007FFE11EB33CD
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE11EB33DA
_RTC_Initialize.LIBCMT ref: 00007FFE11EB3408
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE11EB342E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE11EB3459

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 23933102bea55ea3a88f1b84a54e170b8e476dc20f3646301724dd3938d08095
Instruction ID: e83e5cf40a5a1158396798a7d484290be314fa470462b83bea36be4bd6df5e20
Opcode Fuzzy Hash: 23933102bea55ea3a88f1b84a54e170b8e476dc20f3646301724dd3938d08095
Instruction Fuzzy Hash: 66819D61E0CE4346F754ABE7AC422BB6298BF457A0F5441B7DE0D477B6DE3CE4058608

Function 00007FFE12E11030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE12E11058
__scrt_initialize_crt.LIBCMT ref: 00007FFE12E1109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE12E110AA
_RTC_Initialize.LIBCMT ref: 00007FFE12E110D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE12E110FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFE12E11129

Memory Dump Source

Source File: 00000001.00000002.2938442526.00007FFE12E11000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE12E10000, based on PE: true

Associated: 00000001.00000002.2938423619.00007FFE12E10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2938459898.00007FFE12E12000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.2938476905.00007FFE12E14000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe12e10000_3OQL58yflv.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 24c3fed21fc67ae49763962a26a68a14fa9aac4efc55a0f38d91ad800b1c64bd
Instruction ID: 555e997cab77bd3a8ad823740d2bb546a632f8fc335065c3b9f9bf7017ada4ed
Opcode Fuzzy Hash: 24c3fed21fc67ae49763962a26a68a14fa9aac4efc55a0f38d91ad800b1c64bd
Instruction Fuzzy Hash: EF819D60E0CE4346FB569B679C412BB6290AF45BA0F0440BDD90D8B7B6DEBCE845A612

Function 00007FFE0E1412CC Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE0E1412F4
__scrt_initialize_crt.LIBCMT ref: 00007FFE0E141339
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE0E141346
_RTC_Initialize.LIBCMT ref: 00007FFE0E141374
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE0E14139A
__scrt_release_startup_lock.LIBCMT ref: 00007FFE0E1413C5

Memory Dump Source

Source File: 00000001.00000002.2936726409.00007FFE0E141000.00000020.00000001.01000000.00000026.sdmp, Offset: 00007FFE0E140000, based on PE: true

Associated: 00000001.00000002.2936712283.00007FFE0E140000.00000002.00000001.01000000.00000026.sdmpDownload File
Associated: 00000001.00000002.2936741361.00007FFE0E145000.00000002.00000001.01000000.00000026.sdmpDownload File
Associated: 00000001.00000002.2936757392.00007FFE0E14F000.00000004.00000001.01000000.00000026.sdmpDownload File
Associated: 00000001.00000002.2936771307.00007FFE0E150000.00000002.00000001.01000000.00000026.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe0e140000_3OQL58yflv.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 25c34cf625cfd52ada091fdb65a0fc74a29e9636dd4e47856e36c618d7ae6fa2
Instruction ID: e6088ff77c7022c25876cf9b6be1179ab7e633ec9e8e59787675d6053f2648a6
Opcode Fuzzy Hash: 25c34cf625cfd52ada091fdb65a0fc74a29e9636dd4e47856e36c618d7ae6fa2
Instruction Fuzzy Hash: 66818DE1F0A34766F750AB6694412B92691EF45B80F588437DACD877B6EF3CE8828700

Function 00007FFE110F1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE110F1058
__scrt_initialize_crt.LIBCMT ref: 00007FFE110F109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE110F10AA
_RTC_Initialize.LIBCMT ref: 00007FFE110F10D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE110F10FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFE110F1129

Memory Dump Source

Source File: 00000001.00000002.2937820040.00007FFE110F1000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFE110F0000, based on PE: true

Associated: 00000001.00000002.2937804998.00007FFE110F0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2937836088.00007FFE110F2000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000001.00000002.2937851276.00007FFE110F4000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe110f0000_3OQL58yflv.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 24c3fed21fc67ae49763962a26a68a14fa9aac4efc55a0f38d91ad800b1c64bd
Instruction ID: 283acdbc64a62c0521d5a5f43c35f7dd989c5a7e9eaf528640dd1c99276ceb48
Opcode Fuzzy Hash: 24c3fed21fc67ae49763962a26a68a14fa9aac4efc55a0f38d91ad800b1c64bd
Instruction Fuzzy Hash: 06817D65E0CAC347F7509B6794432FB629BAF96BA0F4840B5EA0C877B6DE3CE5458700

Function 00007FFE11BB1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE11BB1058
__scrt_initialize_crt.LIBCMT ref: 00007FFE11BB109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE11BB10AA
_RTC_Initialize.LIBCMT ref: 00007FFE11BB10D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE11BB10FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFE11BB1129

Memory Dump Source

Source File: 00000001.00000002.2938118027.00007FFE11BB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFE11BB0000, based on PE: true

Associated: 00000001.00000002.2938101310.00007FFE11BB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938133567.00007FFE11BB3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938149100.00007FFE11BB4000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938163229.00007FFE11BB5000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11bb0000_3OQL58yflv.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 632739f6e53f99d3db5e33da1e5c0ad35d4cb4c9218bf9d76c45be126c9d3af3
Instruction ID: cd921e4c4371620cd2e6b644b6f13c4df5dab567804f1508978adce64a0a8128
Opcode Fuzzy Hash: 632739f6e53f99d3db5e33da1e5c0ad35d4cb4c9218bf9d76c45be126c9d3af3
Instruction Fuzzy Hash: 86816961E0DE42C6F7709F67B441AB922ACBF457A0F5460B5E94D87FB6DE2CE4028608

Function 00007FFE11071030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE11071058
__scrt_initialize_crt.LIBCMT ref: 00007FFE1107109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE110710AA
_RTC_Initialize.LIBCMT ref: 00007FFE110710D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE110710FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFE11071129

Memory Dump Source

Source File: 00000001.00000002.2937760077.00007FFE11071000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFE11070000, based on PE: true

Associated: 00000001.00000002.2937744877.00007FFE11070000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2937775020.00007FFE11073000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2937790415.00007FFE11075000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11070000_3OQL58yflv.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 4f5290068470706af306daab517f58543be73385f34af613a25d9ec276a3a886
Instruction ID: dc3e7f9b584665ec1765054e3e1fde3017f3e453cf6250882cddb70b618a8463
Opcode Fuzzy Hash: 4f5290068470706af306daab517f58543be73385f34af613a25d9ec276a3a886
Instruction Fuzzy Hash: ED818F61E1CF4386FB50AB67A4412B962ABBF45BA0F4480B5D9CC877F6DE3CE4468700

Function 00007FFE13301190 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE133011B8
__scrt_initialize_crt.LIBCMT ref: 00007FFE133011FD
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE1330120A
_RTC_Initialize.LIBCMT ref: 00007FFE13301238
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE1330125E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE13301289

Memory Dump Source

Source File: 00000001.00000002.2938594897.00007FFE13301000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2938578259.00007FFE13300000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938612939.00007FFE13303000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938629391.00007FFE13305000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938646123.00007FFE13306000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_3OQL58yflv.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: af286a22ce1a6bda1b61a837db24d3b2e346c07a2ddf6b56baf4002088884885
Instruction ID: cca86d115df7c5f1209c579e96ac74025f6552ff43adc20328f1f9561785276b
Opcode Fuzzy Hash: af286a22ce1a6bda1b61a837db24d3b2e346c07a2ddf6b56baf4002088884885
Instruction Fuzzy Hash: 9981C128E0CE038EF7549B6794412BE2294AF65BB0F1441B5EA2DB77B6DF3CE4458308

Function 00007FFE101D1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE101D1058
__scrt_initialize_crt.LIBCMT ref: 00007FFE101D109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE101D10AA
_RTC_Initialize.LIBCMT ref: 00007FFE101D10D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE101D10FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFE101D1129

Memory Dump Source

Source File: 00000001.00000002.2937326239.00007FFE101D1000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFE101D0000, based on PE: true

Associated: 00000001.00000002.2937311108.00007FFE101D0000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000001.00000002.2937341468.00007FFE101D3000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000001.00000002.2937356318.00007FFE101D4000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000001.00000002.2937371175.00007FFE101D5000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe101d0000_3OQL58yflv.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 13216a91d280a0ad17bb93d9638d94c9aa7988d3a2199bea0cdda77358a17c13
Instruction ID: 42d427f77a34bc7bd24ba71b5b6ff5b0654842b2f30b504e6267511c381d1699
Opcode Fuzzy Hash: 13216a91d280a0ad17bb93d9638d94c9aa7988d3a2199bea0cdda77358a17c13
Instruction Fuzzy Hash: 6681A261F0CE4366FA50AB67A4492B92290BF857A0F5881B7EBCD477B6DE3CE4458700

Function 00007FFE0EA71030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE0EA71058
__scrt_initialize_crt.LIBCMT ref: 00007FFE0EA7109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE0EA710AA
_RTC_Initialize.LIBCMT ref: 00007FFE0EA710D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE0EA710FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFE0EA71129

Memory Dump Source

Source File: 00000001.00000002.2936942642.00007FFE0EA71000.00000020.00000001.01000000.00000023.sdmp, Offset: 00007FFE0EA70000, based on PE: true

Associated: 00000001.00000002.2936928583.00007FFE0EA70000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936956825.00007FFE0EA73000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936970557.00007FFE0EA74000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936984077.00007FFE0EA75000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe0ea70000_3OQL58yflv.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 31d8e522e61a33cf479bf52350be3450eaa8bff41c9a3cd264d2142d6b397c0f
Instruction ID: 28879af4d50f251d96800e7c23eeb02db633c53c60eda6c6fb4680361fa5fa6b
Opcode Fuzzy Hash: 31d8e522e61a33cf479bf52350be3450eaa8bff41c9a3cd264d2142d6b397c0f
Instruction Fuzzy Hash: 7E817F21E1E64386FA50EB65AC512B967F4AF6D784F444039D9CD877B6FE3CE8068700

Function 00007FFE11512A70 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE11512A98
__scrt_initialize_crt.LIBCMT ref: 00007FFE11512ADD
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE11512AEA
_RTC_Initialize.LIBCMT ref: 00007FFE11512B18
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE11512B3E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE11512B69

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: f483b21f41d815f6d6d63f0a13c87fd0f68ae68320ff496c1413c579ba159f5c
Instruction ID: 2a209f774a4a3116ed57907d034c2c01580f23a333c9f98c48bb877cc81ad1d4
Opcode Fuzzy Hash: f483b21f41d815f6d6d63f0a13c87fd0f68ae68320ff496c1413c579ba159f5c
Instruction Fuzzy Hash: A081D5A1E0CE4386FB52AB6794912B922DAAF857F0F6440B5DA0C473B7DF7CE8418700

Function 00007FFE1A459164 Relevance: 16.7, APIs: 11, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4591CC
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4592C9
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A459322
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45934E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A459360
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45938F

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 3cac31fbce2037cca8b65a6457a1f6e1f72e09754060cc87a73fdfbcf94b07ef
Instruction ID: 6fb72a7b33907f36b10538f7b77f9c94779bffe61cc6cabd7b9bce20e22d6a9b
Opcode Fuzzy Hash: 3cac31fbce2037cca8b65a6457a1f6e1f72e09754060cc87a73fdfbcf94b07ef
Instruction Fuzzy Hash: 797140B2B05E46ADFB11EF62D4501FC33B1AB45B9CB4048B2DA0D57AAADF34D625C390

Function 00007FFE11EA7D7C Relevance: 16.7, APIs: 11, Instructions: 157COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFE11EA7EBD

Part of subcall function 00007FFE11EA8120: PyType_GetModuleState.PYTHON312(?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EA8155
Part of subcall function 00007FFE11EA8120: PyEval_SaveThread.PYTHON312(?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EA817C
Part of subcall function 00007FFE11EA8120: PyEval_RestoreThread.PYTHON312(?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EA8195

PyMem_Malloc.PYTHON312 ref: 00007FFE11EA7E48
memcpy.VCRUNTIME140 ref: 00007FFE11EA7E73
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11EA7EF0
PyMem_Realloc.PYTHON312 ref: 00007FFE11EA7F34
memmove.VCRUNTIME140 ref: 00007FFE11EA7F62
PyMem_Free.PYTHON312 ref: 00007FFE11EB4A05
_Py_Dealloc.PYTHON312 ref: 00007FFE11EB4A39

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Mem_$Eval_Threadmemcpy$Bytes_DeallocFreeFromMallocModuleReallocRestoreSaveSizeStateStringType_memmove
String ID:
API String ID: 2023644590-0
Opcode ID: 25f5dba4c9a95c35a1ad65d81cd23aba52be5f89df8b18e19c4da219301fcce9
Instruction ID: 0b52e7b1c042007c74ba6bfc13537d482333465c4a958c1e489eedbdf60a48d7
Opcode Fuzzy Hash: 25f5dba4c9a95c35a1ad65d81cd23aba52be5f89df8b18e19c4da219301fcce9
Instruction Fuzzy Hash: C6516B22E4AE4285EB51CFA2AD4423A63ADFF14FA4F144076DE4E17768DF3DE4918344

Function 00007FFE11BB2170 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE11BB21E3
_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE11BB220B
memmove.VCRUNTIME140 ref: 00007FFE11BB225D
memcpy.VCRUNTIME140 ref: 00007FFE11BB22A5
memcpy.VCRUNTIME140 ref: 00007FFE11BB2389

Strings

(direction == DirEncrypt) || (direction == DirDecrypt), xrefs: 00007FFE11BB2204
src/raw_cfb.c, xrefs: 00007FFE11BB21D5
cfbState->usedKeyStream <= segment_len, xrefs: 00007FFE11BB21DC
src/raw_cfb.c, xrefs: 00007FFE11BB21FD

Memory Dump Source

Source File: 00000001.00000002.2938118027.00007FFE11BB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFE11BB0000, based on PE: true

Associated: 00000001.00000002.2938101310.00007FFE11BB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938133567.00007FFE11BB3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938149100.00007FFE11BB4000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938163229.00007FFE11BB5000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11bb0000_3OQL58yflv.jbxd

Similarity

API ID: _wassertmemcpy$memmove
String ID: (direction == DirEncrypt) || (direction == DirDecrypt)$cfbState->usedKeyStream <= segment_len$src/raw_cfb.c$src/raw_cfb.c
API String ID: 710767724-3209691050
Opcode ID: b649bd0a1d546711c851ea8078f7825d9fd1ee49c3c19a2c630744d5683e58bf
Instruction ID: cb32e8448dcffed200b600cff567d0af5c6e30667e78a33ee559865c6fdf975a
Opcode Fuzzy Hash: b649bd0a1d546711c851ea8078f7825d9fd1ee49c3c19a2c630744d5683e58bf
Instruction Fuzzy Hash: DE610E72A19F81C6E7218F26E400A686B64FB94BE4F0096B1DE8D13F69DF3CE551C304

Function 00007FFE1A45AAC8 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45AB22
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45AC58

Strings

struct , xrefs: 00007FFE1A45AC7C
cointerface , xrefs: 00007FFE1A45ABFF
coclass , xrefs: 00007FFE1A45AC11
enum , xrefs: 00007FFE1A45AC35
class , xrefs: 00007FFE1A45AC6D
`unknown ecsu', xrefs: 00007FFE1A45AAEE
union , xrefs: 00007FFE1A45AC85

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 2943138195-1464470183
Opcode ID: 50e8110e92645124a6d82ffc9330fdaa6dc52167fa44e73d911cd3f80f86a47a
Instruction ID: 6fc5acf3494eeb3f8701cc411fabb80c64b441b178f4a56e7a5f9de271fbf314
Opcode Fuzzy Hash: 50e8110e92645124a6d82ffc9330fdaa6dc52167fa44e73d911cd3f80f86a47a
Instruction Fuzzy Hash: 89518CB2F08F52C9FB11EB66E8841BC27B1BB05B64F5040F6DA5D13AA9DF28E564C340

Function 00007FFE11516888 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE115168CA
_PyDeadline_Get.PYTHON312 ref: 00007FFE11516902
PyErr_CheckSignals.PYTHON312 ref: 00007FFE11516972
PyBuffer_Release.PYTHON312 ref: 00007FFE1151698A
PyBuffer_Release.PYTHON312 ref: 00007FFE115169A5
PyErr_SetString.PYTHON312 ref: 00007FFE115169E8

Strings

timed out, xrefs: 00007FFE115169DE
y*|i:sendall, xrefs: 00007FFE115168B0

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Buffer_Err_Release$Arg_CheckDeadline_ParseSignalsSizeStringTuple_
String ID: timed out$y*|i:sendall
API String ID: 1463051379-3431350491
Opcode ID: fc05db84d42dd3267092a6ef36f8f45a0feb8bd157ffeb6315938a2d8f874bac
Instruction ID: 605ab90946f4a305b77ddc636a2c72abc75010891923cf708a0662d6dc42c8d8
Opcode Fuzzy Hash: fc05db84d42dd3267092a6ef36f8f45a0feb8bd157ffeb6315938a2d8f874bac
Instruction Fuzzy Hash: 7E413D36A08E8286E7129F17E8402AA73AAFB44BA4F544076DE4D53B74DF7CE445C711

Function 00007FFE11516398 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE115163C7
PyErr_SetString.PYTHON312 ref: 00007FFE115163EC
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11516401
_PyBytes_Resize.PYTHON312 ref: 00007FFE1151644A
PyTuple_Pack.PYTHON312 ref: 00007FFE11516461
_Py_Dealloc.PYTHON312 ref: 00007FFE1151647F
_Py_Dealloc.PYTHON312 ref: 00007FFE11516498

Strings

negative buffersize in recvfrom, xrefs: 00007FFE115163E2
n|i:recvfrom, xrefs: 00007FFE115163B4

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Bytes_DeallocSizeStringTuple_$Arg_Err_FromPackParseResize
String ID: negative buffersize in recvfrom$n|i:recvfrom
API String ID: 3092067012-1867657612
Opcode ID: cc238e99d0fac9a70905be5daf0240d15a5e1946d6d8ac169dca63a10d14bba3
Instruction ID: 99c23d160703a2bcc956db3f7f3363bae0326be60c73783972be7d0e9ce14903
Opcode Fuzzy Hash: cc238e99d0fac9a70905be5daf0240d15a5e1946d6d8ac169dca63a10d14bba3
Instruction Fuzzy Hash: AC313C71A49F4281EB568F17E4842B963ABFF84BA4F045075DA4E47778DEBCE044C711

Function 00007FFE1A4537F8 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE1A453996
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4539A3

Part of subcall function 00007FFE1A456E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4529EE), ref: 00007FFE1A456E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A453C57
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A453CA2
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1A453CD7

Strings

csm, xrefs: 00007FFE1A4539BF
csm, xrefs: 00007FFE1A4538DD
csm, xrefs: 00007FFE1A45393F

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: aad8d4203d0b1849c4fce47835e3c613ec0ba3b35d99662ed70f641d37e67567
Instruction ID: 84db0f3033635d0a868e712f29b609f6a017eeff5fc66594e5dbf62a63eb592f
Opcode Fuzzy Hash: aad8d4203d0b1849c4fce47835e3c613ec0ba3b35d99662ed70f641d37e67567
Instruction Fuzzy Hash: 60E1D2B3B08B828AE751AF36D4903BD77A0FB45B68F1401B6DA4D57666CF38E5A1C700

Function 00007FFE0EA72760 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE0EA727DA
memcpy.VCRUNTIME140 ref: 00007FFE0EA727FC
_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE0EA7286E

Strings

src/AESNI.c, xrefs: 00007FFE0EA727CC
src/AESNI.c, xrefs: 00007FFE0EA72860, 00007FFE0EA7298D
(idx>=1) && (idx<=10), xrefs: 00007FFE0EA72867, 00007FFE0EA72994
((Nk==4) && (Nr==10)) || ((Nk==6) && (Nr==12)) || ((Nk==8) && (Nr==14)), xrefs: 00007FFE0EA727D3

Memory Dump Source

Source File: 00000001.00000002.2936942642.00007FFE0EA71000.00000020.00000001.01000000.00000023.sdmp, Offset: 00007FFE0EA70000, based on PE: true

Associated: 00000001.00000002.2936928583.00007FFE0EA70000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936956825.00007FFE0EA73000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936970557.00007FFE0EA74000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936984077.00007FFE0EA75000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe0ea70000_3OQL58yflv.jbxd

Similarity

API ID: _wassert$memcpy
String ID: ((Nk==4) && (Nr==10)) || ((Nk==6) && (Nr==12)) || ((Nk==8) && (Nr==14))$(idx>=1) && (idx<=10)$src/AESNI.c$src/AESNI.c
API String ID: 4292997394-722309440
Opcode ID: d39dd8ff127fcd6812d8991013f514968d842da6ae2888197d778fac17dca971
Instruction ID: a497e1f4b5fc4c8212b2626d4b61290202e15f57842213918d85213ffade13a1
Opcode Fuzzy Hash: d39dd8ff127fcd6812d8991013f514968d842da6ae2888197d778fac17dca971
Instruction Fuzzy Hash: B061CEB2E08A8681EA21CB24E8403B97371FB9C744F518235CACD63675FE3CE58AC740

Function 00007FFE13302568 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

PySequence_Fast.PYTHON312(00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE13302590
PyObject_AsFileDescriptor.PYTHON312(?,?,00007FFE133021E3), ref: 00007FFE13302602
PyErr_SetString.PYTHON312(?,?,00007FFE133021E3), ref: 00007FFE13302688
_Py_Dealloc.PYTHON312(?,?,00007FFE133021E3), ref: 00007FFE1330269C
_Py_Dealloc.PYTHON312(?,?,00007FFE133021E3), ref: 00007FFE133026B0

Strings

arguments 1-3 must be sequences, xrefs: 00007FFE13302589
too many file descriptors in select(), xrefs: 00007FFE1330267E

Memory Dump Source

Source File: 00000001.00000002.2938594897.00007FFE13301000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2938578259.00007FFE13300000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938612939.00007FFE13303000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938629391.00007FFE13305000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938646123.00007FFE13306000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_3OQL58yflv.jbxd

Similarity

API ID: Dealloc$DescriptorErr_FastFileObject_Sequence_String
String ID: arguments 1-3 must be sequences$too many file descriptors in select()
API String ID: 3320488554-3996108163
Opcode ID: 0a082253e6777f62276fcf38ac5eede441174e35d500b13a193befc8f2a7e340
Instruction ID: 695c007cfa1899aea2a36834de64a658eb4880c1c5cb7dca822da5cf19cce21b
Opcode Fuzzy Hash: 0a082253e6777f62276fcf38ac5eede441174e35d500b13a193befc8f2a7e340
Instruction Fuzzy Hash: C2418032A08F068AEB159F16E95413D73A0FBA4BB4F154271DA6E937A4DF7CE450C708

Function 00007FFE1A45C7F8 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C9AC

Part of subcall function 00007FFE1A4594B8: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A459A29
Part of subcall function 00007FFE1A4594B8: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A459A5E

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C95E

Strings

cli::array<, xrefs: 00007FFE1A45C92B
cli::pin_ptr<, xrefs: 00007FFE1A45C975
std::nullptr_t , xrefs: 00007FFE1A45C8EA
void , xrefs: 00007FFE1A45C86A
std::nullptr_t, xrefs: 00007FFE1A45C8D7
void, xrefs: 00007FFE1A45C842

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: 0e84257edd8271f32b759845b73cd3eefe07970f5e22a962a9d02e38f5861642
Instruction ID: a50961141b2aa76dd593645c823cb9b5a686f9e17db93be2c79e1738c74976c0
Opcode Fuzzy Hash: 0e84257edd8271f32b759845b73cd3eefe07970f5e22a962a9d02e38f5861642
Instruction Fuzzy Hash: C2513BA2F18F5298FB519B62D8402BD37B0BB08B68F4442F7DA4D13AA5DF3C91A4C754

Function 00007FFE1151442C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 84networkthreadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312 ref: 00007FFE1151444A
connect.WS2_32 ref: 00007FFE1151445D
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11514468
WSAGetLastError.WS2_32 ref: 00007FFE11514476
WSAGetLastError.WS2_32 ref: 00007FFE11514482
PyErr_CheckSignals.PYTHON312 ref: 00007FFE1151448F
WSASetLastError.WS2_32 ref: 00007FFE115144CC

Strings

3', xrefs: 00007FFE115144B0

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$Eval_Thread$CheckErr_RestoreSaveSignalsconnect
String ID: 3'
API String ID: 4284410693-280543908
Opcode ID: bf1f35104443e8bdc2e2b3dc93d8a66b39ca7049add94a43049c608f9c8392d5
Instruction ID: 8efb142e853869dcdb3ee7dabc35734c82ad8960693e155ff0209f92feb0c9b1
Opcode Fuzzy Hash: bf1f35104443e8bdc2e2b3dc93d8a66b39ca7049add94a43049c608f9c8392d5
Instruction Fuzzy Hash: B5317231B0CF4286EB668F23B4445796AAABF447B8F046175EE5E83BB4DF7CE4408600

Function 00007FFE013C6F58 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE013C6F9D
UnDecorator::getSignedDimension.LIBVCRUNTIME ref: 00007FFE013C6FB4
DName::DName.LIBVCRUNTIME ref: 00007FFE013C702B

Part of subcall function 00007FFE013C1894: DName::doPchar.LIBVCRUNTIME ref: 00007FFE013C18C6

DName::operator+.LIBVCRUNTIME ref: 00007FFE013C703B

Part of subcall function 00007FFE013C1B40: DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C1B5B

DName::operator+.LIBVCRUNTIME ref: 00007FFE013C704E

Part of subcall function 00007FFE013C1BA0: DName::operator+=.LIBCMT ref: 00007FFE013C1BBB

Strings

void, xrefs: 00007FFE013C6F8C
`template-parameter, xrefs: 00007FFE013C7020

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: NameName::Name::operator+Name::operator+=$Decorator::getDimensionName::doPcharSigned
String ID: `template-parameter$void
API String ID: 1951524168-4057429177
Opcode ID: 1f3cece657a09479af9d3c9b893c1911f44fdaa9b7d97bad4018a523c838e630
Instruction ID: 81b39274279d27492b53a5a506eaf05990c9b1ae392bf94444546f09e6a22fb5
Opcode Fuzzy Hash: 1f3cece657a09479af9d3c9b893c1911f44fdaa9b7d97bad4018a523c838e630
Instruction Fuzzy Hash: F6312766B09B5289FB009B65E8612F923A1BB04B88F960032DE0D5F7B5DF6CE409C740

Function 00007FFE1151847C Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 48timeCOMMON

Download Yara Rule

APIs

_PyTime_FromSeconds.PYTHON312(?,?,?,00007FFE11516DDB), ref: 00007FFE11518493
_PyTime_FromSecondsObject.PYTHON312(?,?,?,00007FFE11516DDB), ref: 00007FFE115184AA
PyErr_SetString.PYTHON312(?,?,?,00007FFE11516DDB), ref: 00007FFE115184CD
_PyTime_AsTimeval.PYTHON312(?,?,?,00007FFE11516DDB), ref: 00007FFE115184EA
_PyTime_AsMilliseconds.PYTHON312(?,?,?,00007FFE11516DDB), ref: 00007FFE115184FA
PyErr_SetString.PYTHON312(?,?,?,00007FFE11516DDB), ref: 00007FFE11518533

Strings

timeout doesn't fit into C timeval, xrefs: 00007FFE11518529
Timeout value out of range, xrefs: 00007FFE115184C3

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Time_$Err_FromSecondsString$MillisecondsObjectTimeval
String ID: Timeout value out of range$timeout doesn't fit into C timeval
API String ID: 4240314503-2798848688
Opcode ID: effe227a6c3964277aaa9565c2b565e3918d67ffc16b5f54456a4dcbfcd0fe54
Instruction ID: 2651931b0787d8de23aec916fcaa10107758031b98bf866cf3fe3eb7ef4fc27f
Opcode Fuzzy Hash: effe227a6c3964277aaa9565c2b565e3918d67ffc16b5f54456a4dcbfcd0fe54
Instruction Fuzzy Hash: 4D115135B48E0281FB229B27E490278236ABF44BB4F004279D92E877F0EFACE1448300

Function 00007FFE11EA8264 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE11EA828E
PyObject_GetBuffer.PYTHON312 ref: 00007FFE11EA829E
PyBuffer_IsContiguous.PYTHON312 ref: 00007FFE11EA82AF
PyBuffer_Release.PYTHON312 ref: 00007FFE11EA82DA
_PyArg_BadArgument.PYTHON312 ref: 00007FFE11EB4AAA

Part of subcall function 00007FFE11EA8DA0: PyThread_acquire_lock.PYTHON312(?,?,?,00007FFE11EA82CA), ref: 00007FFE11EA8DC6
Part of subcall function 00007FFE11EA8DA0: PyThread_release_lock.PYTHON312(?,?,?,00007FFE11EA82CA), ref: 00007FFE11EA8DF8

Strings

contiguous buffer, xrefs: 00007FFE11EB4A95
compress, xrefs: 00007FFE11EB4AA3
argument, xrefs: 00007FFE11EB4A9C

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Buffer_$Arg_ArgumentBufferContiguousObject_ReleaseThread_acquire_lockThread_release_lockmemset
String ID: argument$compress$contiguous buffer
API String ID: 1731275941-2310704374
Opcode ID: 33f056bf197bdecfa257246466ee53bf61bb272af1da0f4c28df399c879e47b5
Instruction ID: c0723041d6ea2655c693c64093c8059b9cf65900ef9a88839962ea8c7b967c35
Opcode Fuzzy Hash: 33f056bf197bdecfa257246466ee53bf61bb272af1da0f4c28df399c879e47b5
Instruction Fuzzy Hash: 9811B622B08E4281EB10CBA3EC406BA6368FB88F90F948172DA4D43774EF3CD545C700

Function 00007FFE11515578 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

PyErr_GetRaisedException.PYTHON312 ref: 00007FFE11515585
PyErr_ResourceWarning.PYTHON312 ref: 00007FFE115155AC
PyErr_ExceptionMatches.PYTHON312 ref: 00007FFE115155C0
PyErr_WriteUnraisable.PYTHON312 ref: 00007FFE115155CD
PyEval_SaveThread.PYTHON312 ref: 00007FFE115155DF
closesocket.WS2_32 ref: 00007FFE115155EB
PyEval_RestoreThread.PYTHON312 ref: 00007FFE115155F4

Strings

unclosed %R, xrefs: 00007FFE1151559D

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Err_$Eval_ExceptionThread$MatchesRaisedResourceRestoreSaveUnraisableWarningWriteclosesocket
String ID: unclosed %R
API String ID: 1660182617-2306019038
Opcode ID: 22af9ee66539c4f4bd6f295781fecbb485c16e4539d69cf45f6a771bb75a1004
Instruction ID: 961eeae9d74469aac412c4e556a4fa24c9e1a2e40413b4fda38caaf2801c604a
Opcode Fuzzy Hash: 22af9ee66539c4f4bd6f295781fecbb485c16e4539d69cf45f6a771bb75a1004
Instruction Fuzzy Hash: E501F325A18F4282EB159F23A8040A9636AFF49BB4B081371DD7A437F4DF7CE445C300

Function 00007FFE11518094 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 29stringCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE115180A7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE115180BD
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE115180D8
inet_addr.WS2_32 ref: 00007FFE115180E8
PyErr_SetString.PYTHON312 ref: 00007FFE11518108

Strings

255.255.255.255, xrefs: 00007FFE115180B6
s:inet_aton, xrefs: 00007FFE115180A0
illegal IP address string passed to inet_aton, xrefs: 00007FFE115180FE

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: SizeString$Arg_Bytes_Err_FromParseTuple_inet_addrstrcmp
String ID: 255.255.255.255$illegal IP address string passed to inet_aton$s:inet_aton
API String ID: 717551241-4110412280
Opcode ID: 355c58994951efd5dcf1208cbc122bb6b69380121fe20eeb555166ca54720079
Instruction ID: cc896df0e9a890e9d517305ec931da079f3e9a169ff7147f26716df528d8629b
Opcode Fuzzy Hash: 355c58994951efd5dcf1208cbc122bb6b69380121fe20eeb555166ca54720079
Instruction Fuzzy Hash: BB011261A0CD0382EB129B27E8441B9637BFF857B4F5055B1D61E875B4EF2DD589C700

Function 00007FFE0139E9C8 Relevance: 13.8, APIs: 9, Instructions: 282fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0139EC70: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0139EA46), ref: 00007FFE0139EC90
Part of subcall function 00007FFE0139EC70: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0139EA46), ref: 00007FFE0139ECE6
Part of subcall function 00007FFE0139EC70: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0139EA46), ref: 00007FFE0139ED8B

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFE0139EAA5
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFE0139EAC3
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0139EC54
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE013D64BE
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FFE013D64F1

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: CriticalSection$EnterErrorFileLast$CloseCreateHandleLeaveType
String ID:
API String ID: 3788438030-0
Opcode ID: 1d4586efc608d868f09762b6077f8cee1f43e595acc033dc8482e9515f2cff91
Instruction ID: 080f2470b12570cea0332e8aa0cf1f9d936b837dde4ba5eafa7a44400f89a107
Opcode Fuzzy Hash: 1d4586efc608d868f09762b6077f8cee1f43e595acc033dc8482e9515f2cff91
Instruction Fuzzy Hash: 95C1CF76B28A4285EB10DF68D4801AD3761FB89B98B121235EA6E9B7F5CF3CD456C700

Function 00007FFE130C23CC Relevance: 13.7, APIs: 9, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE130C23F4
__scrt_initialize_crt.LIBCMT ref: 00007FFE130C2439
_RTC_Initialize.LIBCMT ref: 00007FFE130C2474
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE130C249A
__scrt_release_startup_lock.LIBCMT ref: 00007FFE130C24C5

Memory Dump Source

Source File: 00000001.00000002.2938510031.00007FFE130C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2938494029.00007FFE130C0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938526688.00007FFE130C4000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938542624.00007FFE130C6000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938561193.00007FFE130C7000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_3OQL58yflv.jbxd

Similarity

API ID: Initialize__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 2049316269-0
Opcode ID: 3b77cff2cffa30a2d72c19b05c0e679f5008bcc017be56a32988e55e20aec773
Instruction ID: 3dc58cef5b1823b9137158e032c1f8698d0bb5741a3cf491d0870a7ef861eb87
Opcode Fuzzy Hash: 3b77cff2cffa30a2d72c19b05c0e679f5008bcc017be56a32988e55e20aec773
Instruction Fuzzy Hash: 3B81BF21E18E478EFE50AB2798412B922DBAFA07A0FD441F5D90D77BB6DE3CE4418700

Function 00007FFE11511060 Relevance: 13.6, APIs: 9, Instructions: 93COMMON

Download Yara Rule

APIs

PyModule_GetDict.PYTHON312 ref: 00007FFE1151108B
VerSetConditionMask.KERNEL32 ref: 00007FFE115110CA
VerSetConditionMask.KERNEL32 ref: 00007FFE115110D9
VerSetConditionMask.KERNEL32 ref: 00007FFE115110E8
VerifyVersionInfoA.KERNEL32 ref: 00007FFE1151110E
PyUnicode_FromString.PYTHON312 ref: 00007FFE115138EA
_PyDict_Pop.PYTHON312 ref: 00007FFE11513905
_Py_Dealloc.PYTHON312 ref: 00007FFE1151391D
_Py_Dealloc.PYTHON312 ref: 00007FFE11513937

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: ConditionMask$Dealloc$DictDict_FromInfoModule_StringUnicode_VerifyVersion
String ID:
API String ID: 1463663611-0
Opcode ID: 52014d617bdbf1a23e849bdeaec756294a92b9dcc7fe6566fb8264fe441ab811
Instruction ID: 4ce1af4efa544f67ce90849f02832377b6cc285df229734dbebf5ecb372b0380
Opcode Fuzzy Hash: 52014d617bdbf1a23e849bdeaec756294a92b9dcc7fe6566fb8264fe441ab811
Instruction Fuzzy Hash: C5318B36A09F4285EB62CF23A8587A973AABB44BA0F444175CD5E427B4EF3CE645C700

Function 00007FFE1A45662A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A456B10: RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A456B60
Part of subcall function 00007FFE1A456B10: RaiseException.KERNEL32 ref: 00007FFE1A456BA1

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A4566C7
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FFE1A456723

Strings

Bad dynamic_cast!, xrefs: 00007FFE1A456792
Access violation - no RTTI data!, xrefs: 00007FFE1A45662A, 00007FFE1A45684B
Attempted a typeid of nullptr pointer!, xrefs: 00007FFE1A456805
Bad read pointer - no RTTI data!, xrefs: 00007FFE1A456828

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: FileHeader$ExceptionFindInstanceRaiseTargetType
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 1852475696-928371585
Opcode ID: 4ef8ad2c729168d00ef0645f383a1968f42c4eb1f6a8b3717fe5ffb80b324514
Instruction ID: 94ed81efe7f57d1ae8c2a69ed7d50f2aa5380855d6dfe5f07c6e85ae284c8123
Opcode Fuzzy Hash: 4ef8ad2c729168d00ef0645f383a1968f42c4eb1f6a8b3717fe5ffb80b324514
Instruction Fuzzy Hash: 7B5190A2B19E8692DA20EB12F8502B9A360FF44FA4F0445B3DA5D43778DF3CE525C700

Function 00007FFE014342DC Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE01392D60: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013D3A07,?,?,?,?,00007FFE0139720A,?,?,?,00007FFE0139A5D3,?,?,?), ref: 00007FFE01392D6A
Part of subcall function 00007FFE01392D60: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013D3A07,?,?,?,?,00007FFE0139720A,?,?,?,00007FFE0139A5D3,?,?,?), ref: 00007FFE01392DB0

Part of subcall function 00007FFE01434000: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FFE01434040

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,00000000), ref: 00007FFE014343A7
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000), ref: 00007FFE014343B3
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,00000000), ref: 00007FFE014343F3
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,00000000), ref: 00007FFE01434442
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000), ref: 00007FFE0143444F

Strings

., xrefs: 00007FFE01434365
:, xrefs: 00007FFE01434353

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$FullNamePath$CurrentDirectory
String ID: .$:
API String ID: 3092725408-4202072812
Opcode ID: c77f8f494e53075103f17f0137dc06d52f872a3f8c92b5311fda1d3e3cde12f6
Instruction ID: 5e1c34baafd811c5fa6993f9c760edf664c8d92198ca0efb44c2c0cce29b285b
Opcode Fuzzy Hash: c77f8f494e53075103f17f0137dc06d52f872a3f8c92b5311fda1d3e3cde12f6
Instruction Fuzzy Hash: FA518F62F08A1389FB10ABB0E8501FD26A4BF64758F594435DE1D6FBB6EF3CA8418350

Function 00007FFE013C4358 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE013C43C5
DName::DName.LIBVCRUNTIME ref: 00007FFE013C43D4
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C43E3
DName::DName.LIBVCRUNTIME ref: 00007FFE013C43F6

Part of subcall function 00007FFE013C1988: DName::doPchar.LIBVCRUNTIME ref: 00007FFE013C19F5

DName::DName.LIBVCRUNTIME ref: 00007FFE013C4472
DName::DName.LIBVCRUNTIME ref: 00007FFE013C4480

Strings

`non-type-template-parameter, xrefs: 00007FFE013C438B

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: NameName::$Name::doName::operator+Pchar
String ID: `non-type-template-parameter
API String ID: 3026640183-4247534891
Opcode ID: 7324edd943b72a8c1819aec07d8f5cf618c6165273857df94478cefcc2cd1b86
Instruction ID: 8769cb5569313c644fb4ce9721834bdba53bca1feeff6befc4b6536c9a938ab1
Opcode Fuzzy Hash: 7324edd943b72a8c1819aec07d8f5cf618c6165273857df94478cefcc2cd1b86
Instruction Fuzzy Hash: 89416B72A0D792D5EB10CB11E8A01BC77A5BB51B84FA64035DA4D6BBA5DF3CE826C340

Function 00007FFE11EB22B8 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EB2304
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EB2348
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EB2364
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EB23B3

Strings

Unable to allocate output buffer., xrefs: 00007FFE11EB5EC8

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Dealloc$Bytes_FromSizeStringmemcpy
String ID: Unable to allocate output buffer.
API String ID: 76732796-2565006440
Opcode ID: 862a72045ce60d21db495ca697c2b4e567bdc8ae85e2f6742c42c45822477898
Instruction ID: 3fb5858214e9ad179f282a2c13aaa8252f36853fe383d174a46846401edde655
Opcode Fuzzy Hash: 862a72045ce60d21db495ca697c2b4e567bdc8ae85e2f6742c42c45822477898
Instruction Fuzzy Hash: E741F876A0AE0385EB198F96C85426A33A8FF48FA4F188472DE1D47765CF3CE491C308

Function 00007FFE11EAFBC8 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON312(?,?,?,00007FFE11EAFBA6,?,?,?,?,?,00007FFE11EAFB31), ref: 00007FFE11EAFBD5

Part of subcall function 00007FFE11EAFCEC: PyLong_FromUnsignedLongLong.PYTHON312(?,?,?,00007FFE11EAFBF9,?,?,?,00007FFE11EAFBA6,?,?,?,?,?,00007FFE11EAFB31), ref: 00007FFE11EAFD04
Part of subcall function 00007FFE11EAFCEC: PyUnicode_InternFromString.PYTHON312(?,?,?,00007FFE11EAFBF9,?,?,?,00007FFE11EAFBA6,?,?,?,?,?,00007FFE11EAFB31), ref: 00007FFE11EAFD15
Part of subcall function 00007FFE11EAFCEC: PyDict_SetItem.PYTHON312(?,?,?,00007FFE11EAFBF9,?,?,?,00007FFE11EAFBA6,?,?,?,?,?,00007FFE11EAFB31), ref: 00007FFE11EAFD30

PyErr_Format.PYTHON312(?,?,?,00007FFE11EAFBA6,?,?,?,?,?,00007FFE11EAFB31), ref: 00007FFE11EB57C0
_Py_Dealloc.PYTHON312(?,?,?,00007FFE11EAFBA6,?,?,?,?,?,00007FFE11EAFB31), ref: 00007FFE11EB57DC

Strings

dict_size, xrefs: 00007FFE11EAFCC0
start_offset, xrefs: 00007FFE11EB57F8
dist, xrefs: 00007FFE11EB580B
Invalid filter ID: %llu, xrefs: 00007FFE11EB57B3

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Dict_FromLong$DeallocErr_FormatInternItemLong_StringUnicode_Unsigned
String ID: Invalid filter ID: %llu$dict_size$dist$start_offset
API String ID: 1484310907-3368833446
Opcode ID: e83a07305317a98ea39a1dffc3ab200cc08430bf9a336bacd10d1445eee80fbe
Instruction ID: f9ec34e63afe53c0ff24b5e459ada600b270620f8234a3eae4789230d6cfd2cc
Opcode Fuzzy Hash: e83a07305317a98ea39a1dffc3ab200cc08430bf9a336bacd10d1445eee80fbe
Instruction Fuzzy Hash: D3410A31B08E5385EB688B9BED8447A27A8BF05BA4B1451B3CA1D477F0DF3CA465C709

Function 00007FFE1A456FE4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFE1A4571A3,?,?,00000000,00007FFE1A456FD4,?,?,?,?,00007FFE1A456D11), ref: 00007FFE1A457069
GetLastError.KERNEL32(?,?,?,00007FFE1A4571A3,?,?,00000000,00007FFE1A456FD4,?,?,?,?,00007FFE1A456D11), ref: 00007FFE1A457077
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE1A4571A3,?,?,00000000,00007FFE1A456FD4,?,?,?,?,00007FFE1A456D11), ref: 00007FFE1A457090
LoadLibraryExW.KERNEL32(?,?,?,00007FFE1A4571A3,?,?,00000000,00007FFE1A456FD4,?,?,?,?,00007FFE1A456D11), ref: 00007FFE1A4570A2
FreeLibrary.KERNEL32(?,?,?,00007FFE1A4571A3,?,?,00000000,00007FFE1A456FD4,?,?,?,?,00007FFE1A456D11), ref: 00007FFE1A457110
GetProcAddress.KERNEL32(?,?,?,00007FFE1A4571A3,?,?,00000000,00007FFE1A456FD4,?,?,?,?,00007FFE1A456D11), ref: 00007FFE1A45711C

Strings

api-ms-, xrefs: 00007FFE1A457089

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: 76e9ed00015fa7378e2762435fe1c6674923b12dca3248f544122840abba5d3b
Instruction ID: 6664a0b00e140a49ea41bd201f55bccb93ae670519e61bde195a6ec51cb72521
Opcode Fuzzy Hash: 76e9ed00015fa7378e2762435fe1c6674923b12dca3248f544122840abba5d3b
Instruction Fuzzy Hash: D4316F61B1AF8295EE11EB03A8005B563E4BF44FB4F5949B6DD2E4B3A4EF3CE5648300

Function 00007FFE11EB6060 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312(?,?,?,00007FFE11EB4A8B,?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EB6098
PyBytes_FromStringAndSize.PYTHON312(?,?,?,00007FFE11EB4A8B,?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EB60FB
PyList_Append.PYTHON312(?,?,?,00007FFE11EB4A8B,?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EB610F
_Py_Dealloc.PYTHON312(?,?,?,00007FFE11EB4A8B,?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EB612B
_Py_Dealloc.PYTHON312(?,?,?,00007FFE11EB4A8B,?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EB6144

Strings

avail_out is non-zero in _BlocksOutputBuffer_Grow()., xrefs: 00007FFE11EB608E
Unable to allocate output buffer., xrefs: 00007FFE11EB60ED

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: DeallocString$AppendBytes_Err_FromList_Size
String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
API String ID: 1563898963-3455802345
Opcode ID: 6fbf18b8591416a9140e35495b6e81dd91272e89744f2ab46cafb3dfa0ec3d47
Instruction ID: 9299123a967e9b82b3ccdbefb1f35b20ab820e46308503f620f01c402de29259
Opcode Fuzzy Hash: 6fbf18b8591416a9140e35495b6e81dd91272e89744f2ab46cafb3dfa0ec3d47
Instruction Fuzzy Hash: BD313A31A19F4281EB248BABED4412A63A9FB48BF4F1442B2D96D477F5DF3DE4418704

Function 00007FFE013C3178 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE013C319D
UnDecorator::getScopedName.LIBVCRUNTIME ref: 00007FFE013C31D8

Part of subcall function 00007FFE013C630C: UnDecorator::getScope.LIBVCRUNTIME ref: 00007FFE013C6352
Part of subcall function 00007FFE013C630C: DName::operator+.LIBVCRUNTIME ref: 00007FFE013C6366
Part of subcall function 00007FFE013C630C: DName::operator+.LIBVCRUNTIME ref: 00007FFE013C6376

DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C31E5

Part of subcall function 00007FFE013C1C00: DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C1C1B

DName::operator+=.LIBCMT ref: 00007FFE013C321A

Part of subcall function 00007FFE013C1CD0: DName::operator=.LIBVCRUNTIME ref: 00007FFE013C1CFB

Strings

void, xrefs: 00007FFE013C31EC

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+=$Decorator::getNameName::operator+$Name::Name::operator=ScopeScoped
String ID: void
API String ID: 3176039966-3531332078
Opcode ID: 720f34a673e5e0285af4e5d5fa9c7a92715189caa0cb8476876aa2ef7ccb2b61
Instruction ID: f569a13019ed7939d8ed9b5adf3d98e9122efd81e7e91d90645b61a21be588af
Opcode Fuzzy Hash: 720f34a673e5e0285af4e5d5fa9c7a92715189caa0cb8476876aa2ef7ccb2b61
Instruction Fuzzy Hash: A111D372E1D68685EF20EB15E8513BA2371FF94748F418031E98D8F2BADE2CE545C700

Function 00007FFE11516144 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1151616C
PyErr_SetString.PYTHON312 ref: 00007FFE11516191
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE115161A1
_Py_Dealloc.PYTHON312 ref: 00007FFE115161DC
_PyBytes_Resize.PYTHON312 ref: 00007FFE115161F3

Strings

n|i:recv, xrefs: 00007FFE11516165
negative buffersize in recv, xrefs: 00007FFE11516187

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Bytes_SizeString$Arg_DeallocErr_FromParseResizeTuple_
String ID: negative buffersize in recv$n|i:recv
API String ID: 1342606314-3647384195
Opcode ID: 305ed9ba5d92207555bc009bd3fb456f9aa8074bc0363cc4f8e3912babf7d0a1
Instruction ID: 5348c3717574df03efcd7e18cb855869c18023bcb773c7d9581e068fe7636fc6
Opcode Fuzzy Hash: 305ed9ba5d92207555bc009bd3fb456f9aa8074bc0363cc4f8e3912babf7d0a1
Instruction Fuzzy Hash: E7118175A48E4281EF168B53E8441B9A77AFF84BA4F0404B6D94E477B4EFBCE048C710

Function 00007FFE11EA937C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE11EA93A9
PyThread_release_lock.PYTHON312 ref: 00007FFE11EA93DC
PyErr_SetString.PYTHON312 ref: 00007FFE11EA9411
PyEval_SaveThread.PYTHON312 ref: 00007FFE11EB4DE2
PyThread_acquire_lock.PYTHON312 ref: 00007FFE11EB4DF7
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EB4E00

Strings

Already at end of stream, xrefs: 00007FFE11EA9407

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lock
String ID: Already at end of stream
API String ID: 2195683152-1334556646
Opcode ID: 9e63216e7170e21cd5fe165ef3298d122a1dd742ff82655237ff20200b8b85b3
Instruction ID: 80ea9e077d3efe46f941c5e602b75818763a352265d1c8545e5e9a90d5cf5ccd
Opcode Fuzzy Hash: 9e63216e7170e21cd5fe165ef3298d122a1dd742ff82655237ff20200b8b85b3
Instruction Fuzzy Hash: 79112B26A08E4189EB04DB93EC4456A67A8FB88FE4F0840B2DE1E43764CF3CE455C344

Function 00007FFE11EA8DA0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312(?,?,?,00007FFE11EA82CA), ref: 00007FFE11EA8DC6
PyThread_release_lock.PYTHON312(?,?,?,00007FFE11EA82CA), ref: 00007FFE11EA8DF8
PyErr_SetString.PYTHON312(?,?,?,00007FFE11EA82CA), ref: 00007FFE11EA8E28

Part of subcall function 00007FFE11EA82F8: PyType_GetModuleState.PYTHON312 ref: 00007FFE11EA8331
Part of subcall function 00007FFE11EA82F8: PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11EA8345
Part of subcall function 00007FFE11EA82F8: PyList_New.PYTHON312 ref: 00007FFE11EA835C
Part of subcall function 00007FFE11EA82F8: PyEval_SaveThread.PYTHON312 ref: 00007FFE11EA83AD
Part of subcall function 00007FFE11EA82F8: PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EA83C7

PyEval_SaveThread.PYTHON312(?,?,?,00007FFE11EA82CA), ref: 00007FFE11EB4C64
PyThread_acquire_lock.PYTHON312(?,?,?,00007FFE11EA82CA), ref: 00007FFE11EB4C79
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFE11EA82CA), ref: 00007FFE11EB4C82

Strings

Compressor has been flushed, xrefs: 00007FFE11EA8E1E

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Compressor has been flushed
API String ID: 3871537485-3904734015
Opcode ID: d86aa80a21a4b2d71b416a1f9dd74983a5d05c692f482363478d6afc86bb99e5
Instruction ID: 67cca7bbaf83cb614ee16bb5a37bbe83eddf94990d59e4fb335752f700beb395
Opcode Fuzzy Hash: d86aa80a21a4b2d71b416a1f9dd74983a5d05c692f482363478d6afc86bb99e5
Instruction Fuzzy Hash: BE113D21A08E8286EB54CB93FC44A6A63A9FB88FE1F044072DE5E43B24CF3CE455C345

Function 00007FFE11EB2D6C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON312 ref: 00007FFE11EB2D91
PyThread_release_lock.PYTHON312 ref: 00007FFE11EB2DCE
PyErr_SetString.PYTHON312 ref: 00007FFE11EB2DF8

Part of subcall function 00007FFE11EA82F8: PyType_GetModuleState.PYTHON312 ref: 00007FFE11EA8331
Part of subcall function 00007FFE11EA82F8: PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11EA8345
Part of subcall function 00007FFE11EA82F8: PyList_New.PYTHON312 ref: 00007FFE11EA835C
Part of subcall function 00007FFE11EA82F8: PyEval_SaveThread.PYTHON312 ref: 00007FFE11EA83AD
Part of subcall function 00007FFE11EA82F8: PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EA83C7

PyEval_SaveThread.PYTHON312 ref: 00007FFE11EB5F9A
PyThread_acquire_lock.PYTHON312 ref: 00007FFE11EB5FAF
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EB5FB8

Strings

Repeated call to flush(), xrefs: 00007FFE11EB2DEE

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Repeated call to flush()
API String ID: 3871537485-194442007
Opcode ID: ede9bd1f1ae7f9418d51a289d6428b65908c59f9a38676633a3e566431571365
Instruction ID: 5a8962f7a0d0d01a9d971633440ece34b4fbefc2563e17041b0858a0ef40ba4f
Opcode Fuzzy Hash: ede9bd1f1ae7f9418d51a289d6428b65908c59f9a38676633a3e566431571365
Instruction Fuzzy Hash: E9111C21A08E8286EB589BA7EC4467A63A9FF88FE0F044072DA1E47774CF3CE455C705

Function 00007FFE11517D7C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 25networkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE11517D8F
PyErr_SetString.PYTHON312 ref: 00007FFE11517DB2
htons.WS2_32 ref: 00007FFE11517DCD
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE11517DD6

Strings

htons: Python int too large to convert to C 16-bit unsigned integer, xrefs: 00007FFE11517DC4
htons: can't convert negative Python int to C 16-bit unsigned integer, xrefs: 00007FFE11517DA1
i:htons, xrefs: 00007FFE11517D88

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Arg_Err_FromLongLong_ParseSizeStringTuple_Unsignedhtons
String ID: htons: Python int too large to convert to C 16-bit unsigned integer$htons: can't convert negative Python int to C 16-bit unsigned integer$i:htons
API String ID: 1102113319-997571130
Opcode ID: 36cb6b36a595338fecde009dda6759bcf69e474850c10647500bdb103871726e
Instruction ID: cd6499b376dc70504f00052fe5424fb047938126118c23a2ae7a8185685d7703
Opcode Fuzzy Hash: 36cb6b36a595338fecde009dda6759bcf69e474850c10647500bdb103871726e
Instruction Fuzzy Hash: 62F01765A48E0791EB0B8B1BE8901B8237BBF85B61FD014B6C90E871B0EE2CE548D310

Function 00007FFE1A452C38 Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452CF0
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452D0E
__AdjustPointer.LIBCMT ref: 00007FFE1A452D4F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452D5C
__AdjustPointer.LIBCMT ref: 00007FFE1A452D98
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452DAD
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452DF2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452DF9

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: 65b26e5f074ca0aafdff43cbb52cf6556557cf4e92b090b05be647d0b4ff5bec
Instruction ID: a4978e7ee7698631ff501eb76c3296e22e32bc2b5e6074913a1a1f1cd7a594c8
Opcode Fuzzy Hash: 65b26e5f074ca0aafdff43cbb52cf6556557cf4e92b090b05be647d0b4ff5bec
Instruction Fuzzy Hash: 6B51B4A1B09F4281FAA6AB13944467863A4AF44FB4B0944F7EE5D077B5DF3CE466C700

Function 00007FFE1A452E1C Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452ED6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452EF5
__AdjustPointer.LIBCMT ref: 00007FFE1A452F36
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452F43
__AdjustPointer.LIBCMT ref: 00007FFE1A452F7F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452F94
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452FD9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452FE0

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: d568fcbafcd5d9e8e83e95e63f5b62363508f79f2b2b670005157146ca98b55e
Instruction ID: e40670b8eb57816f2c1d056eca00c665782a1e9bb4590be741aafe81845a1856
Opcode Fuzzy Hash: d568fcbafcd5d9e8e83e95e63f5b62363508f79f2b2b670005157146ca98b55e
Instruction Fuzzy Hash: E451D8A2B09E4281EEA5EB53A44463C63A4AF54FB4F0584F7EA5D077B4DF3CE4619700

Function 00007FFE130C2030 Relevance: 12.1, APIs: 8, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FFE130C20B7
MultiByteToWideChar.KERNEL32 ref: 00007FFE130C2139
SysAllocString.OLEAUT32 ref: 00007FFE130C2146
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE130C215B

Memory Dump Source

Source File: 00000001.00000002.2938510031.00007FFE130C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2938494029.00007FFE130C0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938526688.00007FFE130C4000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938542624.00007FFE130C6000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938561193.00007FFE130C7000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_3OQL58yflv.jbxd

Similarity

API ID: ByteCharMultiWide$AllocStringfree
String ID:
API String ID: 3313731-0
Opcode ID: 2df663b260b445d3b0f36d6db8be2b229ae73d703f067d4ca2bcd95855dfc4c3
Instruction ID: 630d923f243be12c4166bd32283717649e854be8015addfb11ae000d44db0c2f
Opcode Fuzzy Hash: 2df663b260b445d3b0f36d6db8be2b229ae73d703f067d4ca2bcd95855dfc4c3
Instruction Fuzzy Hash: 9E418521A04E468DEB159F27941037922D6FF64BB4F9446F5EE6DA7BE5DE3CE0418300

Function 00007FFE01394CE0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151libraryloaderCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01394D38
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01394D82
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FFE013D31E1
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFE013D31F7

Strings

LCMapStringEx, xrefs: 00007FFE013D319A
FlsGetValue, xrefs: 00007FFE013D31ED

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$AddressProcValue
String ID: FlsGetValue$LCMapStringEx
API String ID: 3663398396-552164261
Opcode ID: 2fbef8ac5fa32344c392bc212f7686f577a38a256ad51ea740f3a39413ddaeb9
Instruction ID: 33b9b38c935ecd1f599fcaf55f45d684b4d10eea6d143dfffbab610285f6687a
Opcode Fuzzy Hash: 2fbef8ac5fa32344c392bc212f7686f577a38a256ad51ea740f3a39413ddaeb9
Instruction Fuzzy Hash: C751CF65F0DB5382EB549B25B90027963A0AF49BD8F4A4536DD9D8B7F4DE3CE846C200

Function 00007FFE11BB1D80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 141COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE11BB1DEF
memmove.VCRUNTIME140 ref: 00007FFE11BB1E33
memcpy.VCRUNTIME140 ref: 00007FFE11BB1E67

Strings

src/raw_cfb.c, xrefs: 00007FFE11BB1DE1
@, xrefs: 00007FFE11BB1E6E
cfbState->usedKeyStream <= segment_len, xrefs: 00007FFE11BB1DE8

Memory Dump Source

Source File: 00000001.00000002.2938118027.00007FFE11BB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFE11BB0000, based on PE: true

Associated: 00000001.00000002.2938101310.00007FFE11BB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938133567.00007FFE11BB3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938149100.00007FFE11BB4000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938163229.00007FFE11BB5000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11bb0000_3OQL58yflv.jbxd

Similarity

API ID: _wassertmemcpymemmove
String ID: @$cfbState->usedKeyStream <= segment_len$src/raw_cfb.c
API String ID: 750734614-1361193148
Opcode ID: 291840892e0951460bb4d7aa888ad5ee9f86b5d89407f6ece59ae0693007ec5f
Instruction ID: de31c83f2256a307064e42fd553536484b124fa6fa7055d2f33e4ac91a8fdffe
Opcode Fuzzy Hash: 291840892e0951460bb4d7aa888ad5ee9f86b5d89407f6ece59ae0693007ec5f
Instruction Fuzzy Hash: C851FFA2B18F81C6EB218F2AE4059696368FB95BE4F046671DF8D13B55EF3CE191C304

Function 00007FFE013C473C Relevance: 10.6, APIs: 7, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::doPchar.LIBVCRUNTIME ref: 00007FFE013C47DD
DName::DName.LIBVCRUNTIME ref: 00007FFE013C47E8

Part of subcall function 00007FFE013C1988: DName::doPchar.LIBVCRUNTIME ref: 00007FFE013C19F5

DName::operator+.LIBVCRUNTIME ref: 00007FFE013C47F8

Part of subcall function 00007FFE013C1B40: DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C1B5B

DName::operator+.LIBVCRUNTIME ref: 00007FFE013C4815
DName::operator+.LIBVCRUNTIME ref: 00007FFE013C484A

Part of subcall function 00007FFE013C1B70: DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C1B8B

DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C487D

Part of subcall function 00007FFE013C1D60: DName::append.LIBVCRUNTIME ref: 00007FFE013C1DA4

DName::doPchar.LIBVCRUNTIME ref: 00007FFE013C48DC

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: Name::doName::operator+Name::operator+=Pchar$NameName::Name::append
String ID:
API String ID: 3659116837-0
Opcode ID: 6a84b5c52dd4d7f0a5c210771edd0bbc2f114ba8d2af6fa718f332cbf26e742e
Instruction ID: 258ecd09413b5ecc6d7610dc7d39ef9eb9b77c54d4a28795d71c4164bee4d7a7
Opcode Fuzzy Hash: 6a84b5c52dd4d7f0a5c210771edd0bbc2f114ba8d2af6fa718f332cbf26e742e
Instruction Fuzzy Hash: 0E614572A08B9289E711CF64E8907BD3BA1BB45798F558035EA4E4B7B9EF3DE445C300

Function 00007FFE1A45EB88 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45EBFC
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45EC0B

Part of subcall function 00007FFE1A45CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CE4D
Part of subcall function 00007FFE1A45CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CE86
Part of subcall function 00007FFE1A45CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45D1B1

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45ECAB
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45ECBB
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45ED67

Strings

{for , xrefs: 00007FFE1A45EC34

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+
String ID: {for
API String ID: 2943138195-864106941
Opcode ID: ad201dfe96a96ae0dc6555201844fc758e8e36effd4b63a30410ed7392a88b68
Instruction ID: a7c774f889c1db850d00febc479d16f6673b4272eb53b0ad85fbbb64df639d16
Opcode Fuzzy Hash: ad201dfe96a96ae0dc6555201844fc758e8e36effd4b63a30410ed7392a88b68
Instruction Fuzzy Hash: 4B513CB2B08E45A9F711AF26D4413F837A1EB45B58F4084B2EA4C07BA5DF7CD564C700

Function 00007FFE11EA82F8 Relevance: 10.6, APIs: 7, Instructions: 125threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312 ref: 00007FFE11EA8331
PyBytes_FromStringAndSize.PYTHON312 ref: 00007FFE11EA8345
PyList_New.PYTHON312 ref: 00007FFE11EA835C
PyEval_SaveThread.PYTHON312 ref: 00007FFE11EA83AD
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11EA83C7
_Py_Dealloc.PYTHON312 ref: 00007FFE11EB4AD2
_Py_Dealloc.PYTHON312 ref: 00007FFE11EB4B24

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_ModuleRestoreSaveSizeStateStringType_
String ID:
API String ID: 2831925710-0
Opcode ID: ae1edbe514e34c628d084e20ef8e3ec8416522384ac6af6e2e6a82bbf527068e
Instruction ID: cbaf980c637142245792774e24cebe925a6173bc5602419dd1fd6d5d38d3c06f
Opcode Fuzzy Hash: ae1edbe514e34c628d084e20ef8e3ec8416522384ac6af6e2e6a82bbf527068e
Instruction Fuzzy Hash: 54516E22A08F4286EB649B56AD5467A63A8FF58B71F140276DF5E037A0EF3CE450C304

Function 00007FFE11515950 Relevance: 10.6, APIs: 7, Instructions: 103COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE115159E0
_PyLong_AsInt.PYTHON312 ref: 00007FFE115159FF
PyErr_Occurred.PYTHON312 ref: 00007FFE11515A0C
_PyLong_AsInt.PYTHON312 ref: 00007FFE11515A26
PyErr_Occurred.PYTHON312 ref: 00007FFE11515A33
_PyLong_AsInt.PYTHON312 ref: 00007FFE11515A4D
PyErr_Occurred.PYTHON312 ref: 00007FFE11515A5B

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Err_Long_Occurred$Arg_KeywordsUnpack
String ID:
API String ID: 591546834-0
Opcode ID: 76780f2171b9a0c666538e7470a80e626d3e221b20e6fde9062a3a99cfec385c
Instruction ID: eac910b43ba9baf18d62e0803e807efcfadbd0f508ffa4b8ee724519ad4500ca
Opcode Fuzzy Hash: 76780f2171b9a0c666538e7470a80e626d3e221b20e6fde9062a3a99cfec385c
Instruction Fuzzy Hash: 25419262A59F4146FF529B23A49037522AABF06BBAF180675DE1D437B0EFBCE444C250

Function 00007FFE1A45E174 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFE1A45D86D), ref: 00007FFE1A45E238
DName::DName.LIBVCRUNTIME ref: 00007FFE1A45E257

Strings

`template-parameter, xrefs: 00007FFE1A45E265
void, xrefs: 00007FFE1A45E1BA

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: NameName::atol
String ID: `template-parameter$void
API String ID: 2130343216-4057429177
Opcode ID: 1a349dcf90f4e371f1810c8875e562b3843b42aeee856190ba29246ab6ec8260
Instruction ID: 65f398a89f83fb43c1b66a9be4ed9a392c78d19a3d9c7cbe8bf1b71a77ebed61
Opcode Fuzzy Hash: 1a349dcf90f4e371f1810c8875e562b3843b42aeee856190ba29246ab6ec8260
Instruction Fuzzy Hash: 7A414BA2F08F5688FB11DBA2D8512FC23B1BB48BA4F5441B6DE0C17669DF7CA565C340

Function 00007FFE01391F10 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01391F36
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01391F7D

Part of subcall function 00007FFE01391FC0: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FFE01391FB0), ref: 00007FFE01391FEC
Part of subcall function 00007FFE01391FC0: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FFE01391FB0), ref: 00007FFE01392008

TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FFE013D2B92
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFE013D2BA8

Strings

LCMapStringEx, xrefs: 00007FFE013D2B4D
FlsGetValue, xrefs: 00007FFE013D2B9E

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: CriticalErrorLastSection$AddressEnterLeaveProcValue
String ID: FlsGetValue$LCMapStringEx
API String ID: 2861905401-552164261
Opcode ID: 856ffaa09310a5782805b4071b760ed4b18f18c90a9ebf3c2d04c7b4fc712d45
Instruction ID: 3afb06abd31338cc793ebb5a81dba82c7f2ad7fc4fbcf2f67e0cbfc304322d37
Opcode Fuzzy Hash: 856ffaa09310a5782805b4071b760ed4b18f18c90a9ebf3c2d04c7b4fc712d45
Instruction Fuzzy Hash: 22316066B09B0286FB049B28F85017963A1AF483A4F454636DAAD4B7F4EF7CE849C740

Function 00007FFE1A458EC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE1A458D3C: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A458DFD

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A458F72

Strings

,<ellipsis>, xrefs: 00007FFE1A458F50
,..., xrefs: 00007FFE1A458F40
<ellipsis>, xrefs: 00007FFE1A458FBF
..., xrefs: 00007FFE1A458FAF
void, xrefs: 00007FFE1A458FE4

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 1405650943-2211150622
Opcode ID: cc95b6719b0dfac949915fa95283a824f9a94d2610a8c8b5f10b5de908d24d67
Instruction ID: a452b16370b518dbc48d18b56aeada359cb9f7a9f502f39c13c0ae49ebffb65d
Opcode Fuzzy Hash: cc95b6719b0dfac949915fa95283a824f9a94d2610a8c8b5f10b5de908d24d67
Instruction Fuzzy Hash: A64126B2B08E469CF7029BA6D8502B837B1BB08B68F9445F2CA5C13765DF7CA564D700

Function 00007FFE1A45ACC4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45ADA7

Strings

unsigned , xrefs: 00007FFE1A45AD7B
short , xrefs: 00007FFE1A45AD44
int , xrefs: 00007FFE1A45AD35
long , xrefs: 00007FFE1A45AD26
char , xrefs: 00007FFE1A45AD4D

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: 041e2dffe1b489bc893f09ff0a4f423b3d9eca273271e83df22d622629981137
Instruction ID: 1401689a4dfaf7cc22e032df7bb4adae8887ced41eef325a4d0b7d3a7c4ee6aa
Opcode Fuzzy Hash: 041e2dffe1b489bc893f09ff0a4f423b3d9eca273271e83df22d622629981137
Instruction Fuzzy Hash: FA3151B2B18F5188FB01AF6AD8541BC27B2BB09B55F4481F2DA4C07779DE3C9568CB10

Function 00007FFE01395964 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77libraryloaderCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE01394365), ref: 00007FFE01395978
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE01394365), ref: 00007FFE013959C8
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01394365), ref: 00007FFE013D33AC
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE01394365), ref: 00007FFE013D340F

Strings

LCMapStringEx, xrefs: 00007FFE013D338F
FlsGetValue, xrefs: 00007FFE013D33A2

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$AddressProcValue
String ID: FlsGetValue$LCMapStringEx
API String ID: 3663398396-552164261
Opcode ID: 77e91805ef6c2c8d15ad574c41aafa570b64a8389509183a2b93bcd64b946661
Instruction ID: 001c6de95c322e2078b91755c1efa99d5e35c78c16e1cfe46dbc3c871b036814
Opcode Fuzzy Hash: 77e91805ef6c2c8d15ad574c41aafa570b64a8389509183a2b93bcd64b946661
Instruction Fuzzy Hash: 1C31BF61F1AB0282FB048B54F85017823A1BF49BE8F455135ED9D5F7B4EE2CF8858340

Function 00007FFE01383964 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 76libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013D0FE2,?,?,00000000,00007FFE01392DE9,?,?,?,00007FFE013D3A07), ref: 00007FFE01383978
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013D0FE2,?,?,00000000,00007FFE01392DE9,?,?,?,00007FFE013D3A07), ref: 00007FFE013839C8
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE013D0FE2,?,?,00000000,00007FFE01392DE9,?,?,?,00007FFE013D3A07), ref: 00007FFE013CBBB8
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE013D0FE2,?,?,00000000,00007FFE01392DE9,?,?,?,00007FFE013D3A07), ref: 00007FFE013CBC1B

Strings

LCMapStringEx, xrefs: 00007FFE013CBB9B
FlsGetValue, xrefs: 00007FFE013CBBAE

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$AddressProcValue
String ID: FlsGetValue$LCMapStringEx
API String ID: 3663398396-552164261
Opcode ID: d0ae5395c9465d8d5a6c210d7dce74df9189868eb8276c80af6a09405f8d0d1e
Instruction ID: af1a1a8142cd39882d03be415aee14543a98bcd65f0f45227d93468aea3590fc
Opcode Fuzzy Hash: d0ae5395c9465d8d5a6c210d7dce74df9189868eb8276c80af6a09405f8d0d1e
Instruction Fuzzy Hash: 5C31CE21F1AB0282FB149B55F85117863A1AF48BE8F455135ED5E5F7B8EE3CF8858340

Function 00007FFE0139B980 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01395C62,?,?,?,00007FFE01392DD6,?,?,?,00007FFE013D3A07), ref: 00007FFE0139B9EA

Strings

ext-ms-, xrefs: 00007FFE013D5627
api-ms-, xrefs: 00007FFE013D5614

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: LibraryLoad
String ID: api-ms-$ext-ms-
API String ID: 1029625771-537541572
Opcode ID: 752a545cdf87f99411e6b8a1b9852925cc0a22551ba3af9ac3c65f885d221484
Instruction ID: d63e0943bf9c7a9ff75981a4beb90498876e79b669e3acd8bff157d7e4a799e6
Opcode Fuzzy Hash: 752a545cdf87f99411e6b8a1b9852925cc0a22551ba3af9ac3c65f885d221484
Instruction Fuzzy Hash: 38219C21A29B5281EB149F56A8445B863A4EF49FB4F5A1635CE2E4BBF4DF7CE0018300

Function 00007FFE11517630 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE1151766C
PySys_Audit.PYTHON312 ref: 00007FFE1151768B
PyMem_Free.PYTHON312 ref: 00007FFE115176CC

Strings

idna, xrefs: 00007FFE11517659
socket.gethostbyname, xrefs: 00007FFE11517684
et:gethostbyname, xrefs: 00007FFE11517663

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Arg_AuditFreeMem_ParseSizeSys_Tuple_
String ID: et:gethostbyname$idna$socket.gethostbyname
API String ID: 3195760359-1353326193
Opcode ID: 6e83312ff47425ff525c0c0613081a62e8b85bf134393660fab4544ad1c70ea1
Instruction ID: 1bd21d7fc7d425a4bb3d05fc5cde5f547d723e606012495ec9422c83acf77104
Opcode Fuzzy Hash: 6e83312ff47425ff525c0c0613081a62e8b85bf134393660fab4544ad1c70ea1
Instruction Fuzzy Hash: 54116661718E4282E7119B67E4401AA77A9FF88BE4F401575EE4D47B75DF3CD145C700

Function 00007FFE130C1A50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FFE130C19BF,?,?,?,00007FFE130C1D72), ref: 00007FFE130C1A77
GetProcAddress.KERNEL32(?,?,?,00007FFE130C19BF,?,?,?,00007FFE130C1D72), ref: 00007FFE130C1A94
GetProcAddress.KERNEL32(?,?,?,00007FFE130C19BF,?,?,?,00007FFE130C1D72), ref: 00007FFE130C1AB0

Strings

ReleaseSRWLockExclusive, xrefs: 00007FFE130C1A9F
KERNEL32.DLL, xrefs: 00007FFE130C1A70
AcquireSRWLockExclusive, xrefs: 00007FFE130C1A8A

Memory Dump Source

Source File: 00000001.00000002.2938510031.00007FFE130C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2938494029.00007FFE130C0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938526688.00007FFE130C4000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938542624.00007FFE130C6000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938561193.00007FFE130C7000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_3OQL58yflv.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 569aff2c8a71055cf750ae5eb90cedf63d0a170f748edc3833001cd4e531955e
Instruction ID: de65a1edf7f796f8624c97377282f7ea1993b1871b169acaa18dbb931b158f11
Opcode Fuzzy Hash: 569aff2c8a71055cf750ae5eb90cedf63d0a170f748edc3833001cd4e531955e
Instruction Fuzzy Hash: 8C110920A4EF068DFE698B13B94027522E3AF647B4FDA55F5C81D267B0EE3CB4948340

Function 00007FFE11EB13AC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE11EB13E8
PyMem_Calloc.PYTHON312 ref: 00007FFE11EB13FA
PyErr_SetString.PYTHON312 ref: 00007FFE11EB142B
PyErr_NoMemory.PYTHON312 ref: 00007FFE11EB1435

Strings

Invalid filter specifier for delta filter, xrefs: 00007FFE11EB1421
|OO&, xrefs: 00007FFE11EB13D9

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Err_$Arg_CallocKeywords_Mem_MemoryParseSizeStringTuple
String ID: Invalid filter specifier for delta filter$|OO&
API String ID: 3027669873-2010576982
Opcode ID: 336c5a91de10221a7ac107a06ce397e35615ba1c3d762a728bcba285866718a9
Instruction ID: 4bde7555c7b04ed7353577e09929dc494e2983b5b62a4de92ec95b3214681a29
Opcode Fuzzy Hash: 336c5a91de10221a7ac107a06ce397e35615ba1c3d762a728bcba285866718a9
Instruction Fuzzy Hash: 14110575A09E429AEB048F92EC445AA33A8FB49B74F504077CA0D47370EF3DE85AC754

Function 00007FFE11EB1320 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FFE11EB1359
PyMem_Calloc.PYTHON312 ref: 00007FFE11EB136B
PyErr_SetString.PYTHON312 ref: 00007FFE11EB1398
PyErr_NoMemory.PYTHON312 ref: 00007FFE11EB13A2

Strings

Invalid filter specifier for BCJ filter, xrefs: 00007FFE11EB138E
|OO&, xrefs: 00007FFE11EB133F

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Err_$Arg_CallocKeywords_Mem_MemoryParseSizeStringTuple
String ID: Invalid filter specifier for BCJ filter$|OO&
API String ID: 3027669873-3728029529
Opcode ID: 2d6ea4d5e37d11d661e885e2d778f54c5665b438574322f4c05504b752ed0ffa
Instruction ID: 97df8f47c2ae77c1c536e8e1766a6022b3ac4b7e7214b4daaca198f24040465d
Opcode Fuzzy Hash: 2d6ea4d5e37d11d661e885e2d778f54c5665b438574322f4c05504b752ed0ffa
Instruction Fuzzy Hash: 8501D775A09E0299EB05CB92EC4456E33A8FB44B64F510077C61D43770EF3CE909C758

Function 00007FFE115183A4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLong.PYTHON312 ref: 00007FFE115183C1
PyErr_Occurred.PYTHON312 ref: 00007FFE115183CE
htonl.WS2_32 ref: 00007FFE115183E7
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FFE115183EF
PyErr_Format.PYTHON312 ref: 00007FFE1151840C

Strings

expected int, %s found, xrefs: 00007FFE115183FE

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Err_LongLong_Unsigned$FormatFromOccurredhtonl
String ID: expected int, %s found
API String ID: 3347179618-1178442907
Opcode ID: da3e3c4209e0803c422f0d5816718bff87681f66fc10dfcfafae4169bba37942
Instruction ID: 0b7b516e0724883abfdd57799fe6a0d94fbedfd8442d4a2acb1a9a480efca6c3
Opcode Fuzzy Hash: da3e3c4209e0803c422f0d5816718bff87681f66fc10dfcfafae4169bba37942
Instruction Fuzzy Hash: 21F03124E08E42C2EB669B23E89417963BABF49B75F580575D50F432B0EE3CE488C301

Function 00007FFE1A45ADEC Relevance: 9.2, APIs: 6, Instructions: 161COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1A45AE9E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45AEAE
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45AECB
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45AF3E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45AF67

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 80a690cc5bf4571957900b2ba371d1f0df44bd22a0b18b914ff66e25afa9163e
Instruction ID: 24c0c3a8ebe99c137ac6d4cd598463d31257035ead3d87dccea6baa833f6595b
Opcode Fuzzy Hash: 80a690cc5bf4571957900b2ba371d1f0df44bd22a0b18b914ff66e25afa9163e
Instruction Fuzzy Hash: FB7169B2B08F4289F711DBA2E8902BC37A1BB44B64F5080F6DA1D176A5DF79E462C740

Function 00007FFE0EA71D30 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0EA71D99
_aligned_malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0EA71E06
_aligned_malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0EA71E22
_aligned_free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0EA71E5E
_aligned_free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0EA71E6D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE0EA71E76

Memory Dump Source

Source File: 00000001.00000002.2936942642.00007FFE0EA71000.00000020.00000001.01000000.00000023.sdmp, Offset: 00007FFE0EA70000, based on PE: true

Associated: 00000001.00000002.2936928583.00007FFE0EA70000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936956825.00007FFE0EA73000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936970557.00007FFE0EA74000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936984077.00007FFE0EA75000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe0ea70000_3OQL58yflv.jbxd

Similarity

API ID: _aligned_free_aligned_malloc$callocfree
String ID:
API String ID: 2511558924-0
Opcode ID: 8fb2105fd7c39bf321232f7441f6f1b7ebcf620c9448f78960a77339e4ca462d
Instruction ID: d991f8e5dce6d1fd1978d5b8c34621670d6dee945e8291210b16fa030cc87e22
Opcode Fuzzy Hash: 8fb2105fd7c39bf321232f7441f6f1b7ebcf620c9448f78960a77339e4ca462d
Instruction Fuzzy Hash: 7F413866A0AB4286EB15CB41E85023963B0FF9CB91F494531DECD47BA4FF3CE8968700

Function 00007FFE013A1528 Relevance: 9.1, APIs: 6, Instructions: 83threadCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE013A1539
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE013A158B
FreeLibraryAndExitThread.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFE013A15CE
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE013A160F
ExitThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FFE013A1617

Part of subcall function 00007FFE01393360: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,00000000,00007FFE01392DA4,?,?,?,00007FFE013D3A07,?,?,?,?,00007FFE0139720A,?,?,?), ref: 00007FFE013933D9
Part of subcall function 00007FFE01393360: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FFE01392DA4,?,?,?,00007FFE013D3A07,?,?,?,?,00007FFE0139720A,?,?,?), ref: 00007FFE013CBC5E

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FFE013D737B

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$ExitThread$AddressCloseFreeHandleLibraryProcValue
String ID:
API String ID: 1453037571-0
Opcode ID: 95a0f58f1f6e3fd6a45dde49a93eb3ac7ba2312089a4b71b52672bd475ef0a8e
Instruction ID: aab6464ab63e770ceb42c9e2c148ea3c5783d310e4bc54ae6de01213eefb6a64
Opcode Fuzzy Hash: 95a0f58f1f6e3fd6a45dde49a93eb3ac7ba2312089a4b71b52672bd475ef0a8e
Instruction Fuzzy Hash: A1319E20F0CA0382FB59A730959517C2269AF457B8F5A0734D87E4E6F6DF3CE8458240

Function 00007FFE1A4569F0 Relevance: 9.1, APIs: 6, Instructions: 83stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FFE1A456A43
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A456A86
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE1A456AB0
InterlockedPushEntrySList.KERNEL32 ref: 00007FFE1A456ACD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A456AD9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A456AE2

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-0
Opcode ID: 0fa2fcead297943da074142d2fbec92c84cd60449e30d9ad217028345c3eb4d3
Instruction ID: 2c22617a3d5710520fa0a9b58cdcc255bf9f470f33cf0513c182b61d8dba4c76
Opcode Fuzzy Hash: 0fa2fcead297943da074142d2fbec92c84cd60449e30d9ad217028345c3eb4d3
Instruction Fuzzy Hash: 2631A462B19F9151EA15EB27A80457973A0FF49FF0B5985B2DD2D033A0EE7DE865C300

Function 00007FFE11EAFCEC Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLongLong.PYTHON312(?,?,?,00007FFE11EAFBF9,?,?,?,00007FFE11EAFBA6,?,?,?,?,?,00007FFE11EAFB31), ref: 00007FFE11EAFD04
PyUnicode_InternFromString.PYTHON312(?,?,?,00007FFE11EAFBF9,?,?,?,00007FFE11EAFBA6,?,?,?,?,?,00007FFE11EAFB31), ref: 00007FFE11EAFD15
PyDict_SetItem.PYTHON312(?,?,?,00007FFE11EAFBF9,?,?,?,00007FFE11EAFBA6,?,?,?,?,?,00007FFE11EAFB31), ref: 00007FFE11EAFD30
_Py_Dealloc.PYTHON312(?,?,?,00007FFE11EAFBF9,?,?,?,00007FFE11EAFBA6,?,?,?,?,?,00007FFE11EAFB31), ref: 00007FFE11EB5832
_Py_Dealloc.PYTHON312(?,?,?,00007FFE11EAFBF9,?,?,?,00007FFE11EAFBA6,?,?,?,?,?,00007FFE11EAFB31), ref: 00007FFE11EB584B

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: DeallocFromLong$Dict_InternItemLong_StringUnicode_Unsigned
String ID:
API String ID: 252187852-0
Opcode ID: cb9f6d66bf81f09764608254249e219341844b8bb2ee10869aa05a2e7838a55f
Instruction ID: 700881c0dc94f3f57f73b62f8a703804b05fe07888db8c5d4a6d3c45ba64557e
Opcode Fuzzy Hash: cb9f6d66bf81f09764608254249e219341844b8bb2ee10869aa05a2e7838a55f
Instruction Fuzzy Hash: 1E11302191CE4285EB5A4BA3AD1433E6298BF09FF2F0841B1D91E467F4DF3CE4458346

Function 00007FFE11514668 Relevance: 9.0, APIs: 6, Instructions: 34threadnetworkCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312(?,?,?,00007FFE11514412), ref: 00007FFE1151467C
ioctlsocket.WS2_32 ref: 00007FFE115146A1
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFE11514412), ref: 00007FFE115146AE
PyEval_RestoreThread.PYTHON312(?,?,?,00007FFE11514412), ref: 00007FFE115146B8
WSAGetLastError.WS2_32(?,?,?,00007FFE11514412), ref: 00007FFE115146BE
PyErr_SetExcFromWindowsErr.PYTHON312(?,?,?,00007FFE11514412), ref: 00007FFE115146D0

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Eval_Thread$Restore$Err_ErrorFromLastSaveWindowsioctlsocket
String ID:
API String ID: 863680558-0
Opcode ID: 402f04bb7d9212ea08196dd74a4af80d90a7af6c1d596dfc1541eee4981e6f64
Instruction ID: 3b27bfc02fbe28704bbfa2c1261df9ba11ddfd1644bcc1ee3f82f22c4b325b74
Opcode Fuzzy Hash: 402f04bb7d9212ea08196dd74a4af80d90a7af6c1d596dfc1541eee4981e6f64
Instruction Fuzzy Hash: A9018F71B08E52C2E3019B37E84006A77B9FF88BA0B505070EA5E43B34EE3CD895C701

Function 00007FFE11516F50 Relevance: 9.0, APIs: 6, Instructions: 32threadnetworkCOMMON

Download Yara Rule

APIs

PyLong_AsLongLong.PYTHON312 ref: 00007FFE11516F59
PyErr_Occurred.PYTHON312 ref: 00007FFE11516F68
PyEval_SaveThread.PYTHON312 ref: 00007FFE11516F7C
closesocket.WS2_32 ref: 00007FFE11516F88
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11516F93
WSAGetLastError.WS2_32 ref: 00007FFE11516FA2

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Eval_LongThread$Err_ErrorLastLong_OccurredRestoreSaveclosesocket
String ID:
API String ID: 586723380-0
Opcode ID: 23548299ace1e7fad86091418f4de8e22443fcfbf1b6eb3ae723178575055703
Instruction ID: c5c36217caecd1b8c42205ce96c44ff9fd804a8c4d2d49874a8652f3b0305b63
Opcode Fuzzy Hash: 23548299ace1e7fad86091418f4de8e22443fcfbf1b6eb3ae723178575055703
Instruction Fuzzy Hash: 3DF0F451E1CE4241FB566B636588074627F6F04BB1F5406B4D93E437F4FF6CA444C222

Function 00007FFE1A453F60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A456E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4529EE), ref: 00007FFE1A456E56

EncodePointer.KERNEL32 ref: 00007FFE1A453FD0
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE1A45401B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A45424E

Strings

RCC, xrefs: 00007FFE1A453FEC
MOC, xrefs: 00007FFE1A453FE4

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 93ffbb8a8c38b724cb13d32310db34e78531563cac4ba1370c621256939a6833
Instruction ID: 817ccf16e5f614c8ae2b0fa91b85b32bd61ce66d1facdc8703b5e3ccb96781d0
Opcode Fuzzy Hash: 93ffbb8a8c38b724cb13d32310db34e78531563cac4ba1370c621256939a6833
Instruction Fuzzy Hash: 8591B3B3B08B918AE750DB66E4402BD77B1F744B98F1041AAEE8D4BB65DF38D165C700

Function 00007FFE1A45C540 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C7E0

Strings

std::nullptr_t , xrefs: 00007FFE1A45C770
std::nullptr_t, xrefs: 00007FFE1A45C799
volatile, xrefs: 00007FFE1A45C5B6, 00007FFE1A45C6E7
volatile , xrefs: 00007FFE1A45C5A7, 00007FFE1A45C6D8

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: 01adbf8b940f63687fb8b05ad2c3f4aee868cfabe9c87335b9cb2bee01f92b8d
Instruction ID: 7a7b97423d2f4e3aed724f1d9a5f055a775e46facd1498bf98c907ba038ee296
Opcode Fuzzy Hash: 01adbf8b940f63687fb8b05ad2c3f4aee868cfabe9c87335b9cb2bee01f92b8d
Instruction Fuzzy Hash: C6714AB2B08E4688FB14AB2699500B867B5BB05BA4F8446F7DA4D53AA5DF2CE170C344

Function 00007FFE1A453CF0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A456E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4529EE), ref: 00007FFE1A456E56

EncodePointer.KERNEL32 ref: 00007FFE1A453D4F
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE1A453D9B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A453F57

Strings

MOC, xrefs: 00007FFE1A453D63
RCC, xrefs: 00007FFE1A453D6B

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 8e034f92e989b9960bc08160daca0ef1833c14a7b13808a87468da7d70181806
Instruction ID: e71589378b1fe1701979186732e1bc8cec8fc63fd15ceeb90e19ffd39fffeafd
Opcode Fuzzy Hash: 8e034f92e989b9960bc08160daca0ef1833c14a7b13808a87468da7d70181806
Instruction Fuzzy Hash: 16619773A08FC581D7619B16E4403B9B7A0FB85BA4F0442A6EB9D43765DF3CE1A4CB00

Function 00007FFE11BB1F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE11BB1FEA
memmove.VCRUNTIME140 ref: 00007FFE11BB202E
memcpy.VCRUNTIME140 ref: 00007FFE11BB2123

Strings

src/raw_cfb.c, xrefs: 00007FFE11BB1FDC
cfbState->usedKeyStream <= segment_len, xrefs: 00007FFE11BB1FE3

Memory Dump Source

Source File: 00000001.00000002.2938118027.00007FFE11BB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFE11BB0000, based on PE: true

Associated: 00000001.00000002.2938101310.00007FFE11BB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938133567.00007FFE11BB3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938149100.00007FFE11BB4000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938163229.00007FFE11BB5000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11bb0000_3OQL58yflv.jbxd

Similarity

API ID: _wassertmemcpymemmove
String ID: cfbState->usedKeyStream <= segment_len$src/raw_cfb.c
API String ID: 750734614-977067101
Opcode ID: 190ca472f54348da95aaf15e0cc56e810afdec70c59e9a35399ab383c56dfc83
Instruction ID: 02976fb5d53fe5c2a881acff136b928d279f37540f88ebb3467c713be4754f46
Opcode Fuzzy Hash: 190ca472f54348da95aaf15e0cc56e810afdec70c59e9a35399ab383c56dfc83
Instruction Fuzzy Hash: 6D5134A2B05F9582E7158F2AD4049696764FB54FE4F44A6B2DE8803B55EF3CE192C304

Function 00007FFE1A455C50 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 135COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A455D22

Strings

csm, xrefs: 00007FFE1A455DDF
csm, xrefs: 00007FFE1A455CB2
RCC, xrefs: 00007FFE1A455C9C
MOC, xrefs: 00007FFE1A455C90

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: FileHeader
String ID: MOC$RCC$csm$csm
API String ID: 104395404-1441736206
Opcode ID: 5815091cf7d4bf77be2b6452b49c3696097c0f3c73df3e225fc204c9d15c1510
Instruction ID: 0498f6a2c30bcfe646609de0339eedfc56350870012fcedeb6dc47dcf2698f5c
Opcode Fuzzy Hash: 5815091cf7d4bf77be2b6452b49c3696097c0f3c73df3e225fc204c9d15c1510
Instruction Fuzzy Hash: 2F5190B2B09A4296EAA0AB27914417D76A0FF44F65F1440F3EE4D87761DF3CE4718B82

Function 00007FFE013C67C8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator+=.LIBVCRUNTIME ref: 00007FFE013C690D
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C692B
DName::operator+=.LIBVCRUNTIME ref: 00007FFE013C6937
DName::operator+=.LIBCMT ref: 00007FFE013C694B

Strings

..., xrefs: 00007FFE013C6941

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+=$Replicator::operator+=
String ID: ...
API String ID: 3157425598-440645147
Opcode ID: ab6ba9168d8245f58e0df429e84d23090a613f1e1c8d9c4495997a013b9c4c19
Instruction ID: 02be0cbaec47c2e43d2928e1e28e4dcd525eaf196c77a06e1f666b7b82412a61
Opcode Fuzzy Hash: ab6ba9168d8245f58e0df429e84d23090a613f1e1c8d9c4495997a013b9c4c19
Instruction Fuzzy Hash: E9517AF2E0D78289FB11CB25E8553B92BA1BB45B94F198135DA4D0B7B5CF3DE4458300

Function 00007FFE11EAFEA4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

PySequence_Size.PYTHON312(00000000,?,00000000,00007FFE11EAFE54), ref: 00007FFE11EAFED0
PySequence_GetItem.PYTHON312(?,00000000,00007FFE11EAFE54), ref: 00007FFE11EAFF03

Part of subcall function 00007FFE11EAFF98: PyMapping_Check.PYTHON312(?,?,?,00000028,00007FFE11EAFF1F,?,00000000,00007FFE11EAFE54), ref: 00007FFE11EAFFBD
Part of subcall function 00007FFE11EAFF98: PyMapping_GetItemString.PYTHON312(?,?,?,00000028,00007FFE11EAFF1F,?,00000000,00007FFE11EAFE54), ref: 00007FFE11EAFFD7
Part of subcall function 00007FFE11EAFF98: PyLong_AsUnsignedLongLong.PYTHON312(?,?,?,00000028,00007FFE11EAFF1F,?,00000000,00007FFE11EAFE54), ref: 00007FFE11EAFFEC
Part of subcall function 00007FFE11EAFF98: PyErr_Occurred.PYTHON312(?,?,?,00000028,00007FFE11EAFF1F,?,00000000,00007FFE11EAFE54), ref: 00007FFE11EB0003

PyErr_Format.PYTHON312(?,00000000,00007FFE11EAFE54), ref: 00007FFE11EB5891

Strings

Too many filters - liblzma supports a maximum of %d, xrefs: 00007FFE11EB5881

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Err_ItemLongMapping_Sequence_$CheckFormatLong_OccurredSizeStringUnsigned
String ID: Too many filters - liblzma supports a maximum of %d
API String ID: 1062705235-2617632755
Opcode ID: a8dce6b49c4721e3ac7d76778cdd951f8e883f2d6d20fc7a22e019174aa26525
Instruction ID: 0e35c6e4a93c02be0d20ac454650096dc416b67a538b3aecbb6758e8c90b3759
Opcode Fuzzy Hash: a8dce6b49c4721e3ac7d76778cdd951f8e883f2d6d20fc7a22e019174aa26525
Instruction Fuzzy Hash: 5E314925A08E0285EB545BA7BC4013A6698BB46FF4F184375EE3D477F5DE3CE0828245

Function 00007FFE11EB153C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON312 ref: 00007FFE11EB1592
PyErr_Format.PYTHON312 ref: 00007FFE11EB5C5C

Strings

Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter, xrefs: 00007FFE11EB5CAF
Invalid compression preset: %u, xrefs: 00007FFE11EB5C52

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Err_$FormatOccurred
String ID: Invalid compression preset: %u$Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter
API String ID: 4038069558-4068623215
Opcode ID: 235a281b19c4b2400142f3efbfa73511de27b2f502db4f0261cc45130d1b64e3
Instruction ID: 02b1736bcdb951cf7c5268e829ec57949b99b74b4c670c128cf18e09f812e0b8
Opcode Fuzzy Hash: 235a281b19c4b2400142f3efbfa73511de27b2f502db4f0261cc45130d1b64e3
Instruction Fuzzy Hash: 8A217121B1DE4285EB209BA6AC4037B2398BF89BB4F441672D95E473F5DE2CE5048B04

Function 00007FFE10232400 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE10232444
memcpy.VCRUNTIME140 ref: 00007FFE1023247F

Strings

@, xrefs: 00007FFE1023248D
D:\a\pycryptodome\pycryptodome\src\hash_SHA2_template.c, xrefs: 00007FFE10232436
hs->curlen < BLOCK_SIZE, xrefs: 00007FFE1023243D

Memory Dump Source

Source File: 00000001.00000002.2937462956.00007FFE10231000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFE10230000, based on PE: true

Associated: 00000001.00000002.2937447788.00007FFE10230000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2937477787.00007FFE10235000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2937492187.00007FFE10236000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2937505821.00007FFE10237000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe10230000_3OQL58yflv.jbxd

Similarity

API ID: _wassertmemcpy
String ID: @$D:\a\pycryptodome\pycryptodome\src\hash_SHA2_template.c$hs->curlen < BLOCK_SIZE
API String ID: 785382960-4190453202
Opcode ID: 9866ec4c9cf0936fe4a954d78d9ff4afd309cd52094dbb7c2e93bcceac7e3399
Instruction ID: 424657901676d2c78de8a0494ffe2c066cc9b4f7d8edb6845cb33cf488c0b53c
Opcode Fuzzy Hash: 9866ec4c9cf0936fe4a954d78d9ff4afd309cd52094dbb7c2e93bcceac7e3399
Instruction Fuzzy Hash: 51217176B08A11CBEB589F16E1542697B60FB9EBA4F144075DF4A0BB6ACB3CD845C700

Function 00007FFE1151678C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FFE115167B7

Part of subcall function 00007FFE11515144: WSAGetLastError.WS2_32 ref: 00007FFE115151EB
Part of subcall function 00007FFE11515144: WSAGetLastError.WS2_32 ref: 00007FFE115151F3
Part of subcall function 00007FFE11515144: PyErr_CheckSignals.PYTHON312 ref: 00007FFE11515204

PyBuffer_Release.PYTHON312 ref: 00007FFE1151681C
PyBuffer_Release.PYTHON312 ref: 00007FFE11516826
PyLong_FromSsize_t.PYTHON312 ref: 00007FFE11516831

Strings

y*|i:send, xrefs: 00007FFE115167B0

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Buffer_ErrorLastRelease$Arg_CheckErr_FromLong_ParseSignalsSizeSsize_tTuple_
String ID: y*|i:send
API String ID: 3302300731-3140140677
Opcode ID: 9d902cd2a80d089053f697548214e4ad2e14000c8d8ac14ad480a3aadbdcc03a
Instruction ID: 9626010b79eb3ad9d6a3d882bb43374cd7b0a263e3bd508b1a1965d6a5e03613
Opcode Fuzzy Hash: 9d902cd2a80d089053f697548214e4ad2e14000c8d8ac14ad480a3aadbdcc03a
Instruction Fuzzy Hash: 9A112AB1A08F4692E7119F66E4443AA73B9FB887A4F100176DA8D83774EF7DD448CB50

Function 00007FFE130C1010 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FFE130C1064
_PyArg_BadArgument.PYTHON312 ref: 00007FFE130C109D

Strings

str, xrefs: 00007FFE130C1088
argument 'query', xrefs: 00007FFE130C108F
exec_query, xrefs: 00007FFE130C1096

Memory Dump Source

Source File: 00000001.00000002.2938510031.00007FFE130C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2938494029.00007FFE130C0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938526688.00007FFE130C4000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938542624.00007FFE130C6000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938561193.00007FFE130C7000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_3OQL58yflv.jbxd

Similarity

API ID: Arg_$ArgumentKeywordsUnpack
String ID: argument 'query'$exec_query$str
API String ID: 139282824-2846418808
Opcode ID: 8a8a1c7d9e9e2c935ebeb999dcd53c24d42eb6c85c89a84b56cea3840578ce47
Instruction ID: a41de501acbf1582efe800e06800a63e2c5f8f72a723de4925a00328f9812366
Opcode Fuzzy Hash: 8a8a1c7d9e9e2c935ebeb999dcd53c24d42eb6c85c89a84b56cea3840578ce47
Instruction Fuzzy Hash: DE018BB1A18F8289EA15CB02E8443A572E2FF64BA8FD141B5D94D27375EF7DE509CB00

Function 00007FFE0141D60C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00007FFE0141EEF8), ref: 00007FFE0141D631
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00007FFE0141EEF8), ref: 00007FFE0141D63D

Part of subcall function 00007FFE0141D710: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FFE0141D721

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,00007FFE0141EEF8), ref: 00007FFE0141D66F
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00007FFE0141EEF8), ref: 00007FFE0141D690

Strings

CONOUT$, xrefs: 00007FFE0141D65B

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: a7527d7c958e88b7a470d175e70615f5c762764475a5e5c50c5f4dd4f1ad084e
Instruction ID: fa14cdceceb2ea461eb06ad66f0acf2bfd2792421f6ac9eef8734e6cb5e53b42
Opcode Fuzzy Hash: a7527d7c958e88b7a470d175e70615f5c762764475a5e5c50c5f4dd4f1ad084e
Instruction Fuzzy Hash: 5B113976A18A4686E7608F56E44436973A0FB8CB99F104535DA8E4BB38CF7CD855CB01

Function 00007FFE0139FF64 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFE0139FF80
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFE0139FF9E
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFE013D6DEA

Strings

mscoree.dll, xrefs: 00007FFE0139FF77
CorExitProcess, xrefs: 00007FFE013D6DE3

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a0fa5bb4aeebfe9c680639c86b58bde78110295bab5223d35b999981a134c111
Instruction ID: 9c7cf26328b68ab4f94fa4fd2657ea457397f789f67691f4258051d6809f8d13
Opcode Fuzzy Hash: a0fa5bb4aeebfe9c680639c86b58bde78110295bab5223d35b999981a134c111
Instruction Fuzzy Hash: 05F03A61A1DA0286FF548B60E8843792764AF59749F441435E40F8E2B4DF6CE898C740

Function 00007FFE133010E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE133010ED
PyUnicode_InternFromString.PYTHON312 ref: 00007FFE133010FD
PyModule_AddObjectRef.PYTHON312 ref: 00007FFE1330111F

Strings

error, xrefs: 00007FFE13301112
close, xrefs: 00007FFE133010F3

Memory Dump Source

Source File: 00000001.00000002.2938594897.00007FFE13301000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2938578259.00007FFE13300000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938612939.00007FFE13303000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938629391.00007FFE13305000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938646123.00007FFE13306000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_3OQL58yflv.jbxd

Similarity

API ID: Module_$FromInternObjectStateStringUnicode_
String ID: close$error
API String ID: 4029360594-371397155
Opcode ID: b00ee18b52f09e43015f11ecc5196efd95cb15d53436f0639fb64e3f7d15bcef
Instruction ID: 3e9b39983941d173775ccaac96f589a15e8dd15be820502070fcf9acc97b2239
Opcode Fuzzy Hash: b00ee18b52f09e43015f11ecc5196efd95cb15d53436f0639fb64e3f7d15bcef
Instruction Fuzzy Hash: 20F03A25A09E4795EA089B66F84407E2364BF2DBB4F444176DA2D673B0DF3CD0598308

Function 00007FFE11514A70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

_Py_BuildValue_SizeT.PYTHON312(?,?,00000002,00007FFE11514E38), ref: 00007FFE11514A8B
PyErr_SetObject.PYTHON312(?,?,00000002,00007FFE11514E38), ref: 00007FFE11514AA0
_Py_Dealloc.PYTHON312(?,?,00000002,00007FFE11514E38), ref: 00007FFE11514AB4

Strings

getaddrinfo failed, xrefs: 00007FFE11514A7D
(is), xrefs: 00007FFE11514A84

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: BuildDeallocErr_ObjectSizeValue_
String ID: (is)$getaddrinfo failed
API String ID: 3413694139-582941868
Opcode ID: 6d3696d45c9a8b2b7f632d13abba6ccc3b07fd922a482b1a9f600298cf0d48ef
Instruction ID: f9dd6cfdafcf996e3b9336124cd0343f0708006bdc31af5a230b158d79933ea5
Opcode Fuzzy Hash: 6d3696d45c9a8b2b7f632d13abba6ccc3b07fd922a482b1a9f600298cf0d48ef
Instruction Fuzzy Hash: 97F01C22A08E4381EB069F63E8981B823FBEF48BA5F455071CA1D46774EF7CE485C700

Function 00007FFE013EEC48 Relevance: 7.8, APIs: 5, Instructions: 344COMMON

Download Yara Rule

APIs

GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFE013EED1C
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFE013EEE3D
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFE013EEF53
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFE013EEFD9
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FFE013EF0A7

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 15a8164fef82a85ab5440084c303d4fae747831679e295b0d13bbbe827c8cb33
Instruction ID: e77c89d90cc4e8006e9fd239c18274782c3c6715021722395ad2c5f58f2fcbf7
Opcode Fuzzy Hash: 15a8164fef82a85ab5440084c303d4fae747831679e295b0d13bbbe827c8cb33
Instruction Fuzzy Hash: 07D1C012E0C38246FB746B64849027E6AD5AF65794F574236E95C0EBFCCE7EE8858301

Function 00007FFE013A1E24 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013A1E19), ref: 00007FFE013A1E8A
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013A1E19), ref: 00007FFE013A1EB7
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013A1E19), ref: 00007FFE013D75C3
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013A1E19), ref: 00007FFE013D75D0
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013A1E19), ref: 00007FFE013D7607

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: FullNamePath$ErrorLast
String ID:
API String ID: 457693415-0
Opcode ID: 0f3d5973385eec4d98cb3dfa90842043fe91ebd008eb98af393fafc93bd508fb
Instruction ID: dc65b648b8d0b790315bd1b356140d2d5a89b90975e5a505040afffe5878fa6f
Opcode Fuzzy Hash: 0f3d5973385eec4d98cb3dfa90842043fe91ebd008eb98af393fafc93bd508fb
Instruction Fuzzy Hash: 1631E125F08B5286FB24AB71E8044BC32A5BF44B88F594535DE5E6BBB5DF3CE8418340

Function 00007FFE1A45A920 Relevance: 7.6, APIs: 5, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1A45A99B
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A9BD
DName::DName.LIBVCRUNTIME ref: 00007FFE1A45A9CC
DName::DName.LIBVCRUNTIME ref: 00007FFE1A45AA03
DName::DName.LIBVCRUNTIME ref: 00007FFE1A45AA0E

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: f125dc20a4fc2cff283c2e4d5124f38be857c51718d1d3c9008137230ed817e4
Instruction ID: c27719cab2395f36c17cfd406b8932f99f659b90677ac9e23bdfdc20e0fe4823
Opcode Fuzzy Hash: f125dc20a4fc2cff283c2e4d5124f38be857c51718d1d3c9008137230ed817e4
Instruction Fuzzy Hash: 54414CA2B19F5298EB10EB22E8541B827B4BF15FA4F9444F3DA4D537A5DF38E865C300

Function 00007FFE11BB23F0 Relevance: 7.6, APIs: 6, Instructions: 76COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE11BB245E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE11BB2478
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE11BB2490
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE11BB24A3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE11BB24AC
memcpy.VCRUNTIME140 ref: 00007FFE11BB24E9

Memory Dump Source

Source File: 00000001.00000002.2938118027.00007FFE11BB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFE11BB0000, based on PE: true

Associated: 00000001.00000002.2938101310.00007FFE11BB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938133567.00007FFE11BB3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938149100.00007FFE11BB4000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000001.00000002.2938163229.00007FFE11BB5000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11bb0000_3OQL58yflv.jbxd

Similarity

API ID: calloc$free$memcpy
String ID:
API String ID: 3937003943-0
Opcode ID: 9bc8d67156ad3f452768cdaea32a448c3d61317b4a210aaa2a65c8f186b35c59
Instruction ID: 5eedbd76ac92de062582d0ef605d2892b51ddc1db48ac91669ad6e186961589c
Opcode Fuzzy Hash: 9bc8d67156ad3f452768cdaea32a448c3d61317b4a210aaa2a65c8f186b35c59
Instruction Fuzzy Hash: 51313625A09F41C6EB248F16E444B2962B9FF48BA0F1464B5DF4D07FA9EE3CE8958344

Function 00007FFE133026F0 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

__WSAFDIsSet.WS2_32 ref: 00007FFE13302716
PyList_New.PYTHON312(00007FFDFB761B70,?,?,00007FFE133021E3), ref: 00007FFE1330273C
__WSAFDIsSet.WS2_32 ref: 00007FFE13302768
PyList_SetItem.PYTHON312(?,?,00007FFE133021E3), ref: 00007FFE13302782
_Py_Dealloc.PYTHON312(?,?,00007FFE133021E3), ref: 00007FFE133027C9

Memory Dump Source

Source File: 00000001.00000002.2938594897.00007FFE13301000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2938578259.00007FFE13300000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938612939.00007FFE13303000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938629391.00007FFE13305000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938646123.00007FFE13306000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_3OQL58yflv.jbxd

Similarity

API ID: List_$DeallocItem
String ID:
API String ID: 1559017468-0
Opcode ID: 0510465720fbbf57f064ff2e3727586b04389ca9bb4a7a224825a4f618bb6ef6
Instruction ID: 28495415e6c956d2b22cfbedcf7e6d329cbe01a92e54528971544efb1404ef89
Opcode Fuzzy Hash: 0510465720fbbf57f064ff2e3727586b04389ca9bb4a7a224825a4f618bb6ef6
Instruction Fuzzy Hash: E021A932A18B028AEB248F12E5442AE73B1FB68FA0F844475DB5EA3765DF3DE055C304

Function 00007FFE013A46B0 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE013A11EC: GetModuleHandleExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE013A1178), ref: 00007FFE013A1230

CreateThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FFE013A46FA
ResumeThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FFE013A4713
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE013D838D
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FFE013D83A9
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFE013D83B8

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: HandleThread$CloseCreateErrorFreeLastLibraryModuleResume
String ID:
API String ID: 1364334503-0
Opcode ID: b68a7a0fac91d9d1845244722fd2157da5691920a39cb700d62bacc8eb217cd8
Instruction ID: bb9a92ac6fba721e9da5e08718599d3d8ee2ac0277d21f954622a3544a026179
Opcode Fuzzy Hash: b68a7a0fac91d9d1845244722fd2157da5691920a39cb700d62bacc8eb217cd8
Instruction Fuzzy Hash: 00219025A0EB4282FF249B64E8502B962A4BF45BB4F590735DA7E0A3F5DF7DF4008240

Function 00007FFE013B33D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFE013B33FC
_set_statfp.LIBCMT ref: 00007FFE013B3417
_set_statfp.LIBCMT ref: 00007FFE013B3433
_set_statfp.LIBCMT ref: 00007FFE013B346F

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: d87a420c425093582bf0768a505271f7d8736b4892105bec4a5daca04c7c3215
Instruction ID: 7567850f8f2c5a80016aa86f62a34bb17ad59e0136e27b0b626cd884a6b4ed1c
Opcode Fuzzy Hash: d87a420c425093582bf0768a505271f7d8736b4892105bec4a5daca04c7c3215
Instruction Fuzzy Hash: 1711E52AE1CA3305FB961168E4C63791040BF96374F4B0A35EB7E6E2F7BE1CA9814200

Function 00007FFE13301070 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE13301086
_Py_Dealloc.PYTHON312 ref: 00007FFE13302096

Memory Dump Source

Source File: 00000001.00000002.2938594897.00007FFE13301000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2938578259.00007FFE13300000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938612939.00007FFE13303000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938629391.00007FFE13305000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938646123.00007FFE13306000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_3OQL58yflv.jbxd

Similarity

API ID: DeallocModule_State
String ID:
API String ID: 1903735390-0
Opcode ID: 29ba12ce9a091516bd5ec055b50f0585dfd5d964cbc4b820affa4f0832a20046
Instruction ID: 7e16eada0ad6e39f9fbaa75d56ef4f5e44deeaec5ef999716a93a86e3ee32f52
Opcode Fuzzy Hash: 29ba12ce9a091516bd5ec055b50f0585dfd5d964cbc4b820affa4f0832a20046
Instruction Fuzzy Hash: DB212C35D09E82CDFB595F73C64437C32A4AB69B39F1440B1C6AEA21A1CF7EA484C309

Function 00007FFE11EB2F9C Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON312 ref: 00007FFE11EB2FAA
_Py_Dealloc.PYTHON312 ref: 00007FFE11EB301F
_Py_Dealloc.PYTHON312 ref: 00007FFE11EB3027
_Py_Dealloc.PYTHON312 ref: 00007FFE11EB5FC4

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Dealloc$Module_State
String ID:
API String ID: 3434497292-0
Opcode ID: 9b301df99932a2c34feb3b2f767aa745cc02169cdf38237671620287c41aeb36
Instruction ID: 33d1c66f1b4933ee4cc4c968939bc7d1098298b4b5aeaa182ca70e901dddb400
Opcode Fuzzy Hash: 9b301df99932a2c34feb3b2f767aa745cc02169cdf38237671620287c41aeb36
Instruction Fuzzy Hash: 70210032D1EE0789FB594FB6CC1573A22A8BF14F25F1440B2D90E556A1CF3DA481D318

Function 00007FFE11516EBC Relevance: 7.5, APIs: 5, Instructions: 33threadCOMMON

Download Yara Rule

APIs

_PyLong_AsInt.PYTHON312 ref: 00007FFE11516ECC
PyErr_Occurred.PYTHON312 ref: 00007FFE11516ED9
PyEval_SaveThread.PYTHON312 ref: 00007FFE11516EED
shutdown.WS2_32 ref: 00007FFE11516EFC
PyEval_RestoreThread.PYTHON312 ref: 00007FFE11516F07

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Eval_Thread$Err_Long_OccurredRestoreSaveshutdown
String ID:
API String ID: 24305128-0
Opcode ID: ab70f0809716880a260891902c4992cf86772b9ffdbb117dac050b74a4e95bf6
Instruction ID: 0753a54175768fb4878c235a73022829eb7a052cb298bac3c6c2d14d191fab13
Opcode Fuzzy Hash: ab70f0809716880a260891902c4992cf86772b9ffdbb117dac050b74a4e95bf6
Instruction Fuzzy Hash: B5016D25B08F4282EB229B63B48407A627ABF48BB0B044674DA5E43774EF7CE485C620

Function 00007FFE1A45470C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A456E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4529EE), ref: 00007FFE1A456E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A45488B

Strings

, xrefs: 00007FFE1A4547DC
csm, xrefs: 00007FFE1A45475B
csm, xrefs: 00007FFE1A4548C5

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: abort
String ID: $csm$csm
API String ID: 4206212132-1512788406
Opcode ID: bd14039b9dc44c48f3afba7226bd4a8f48c08aeb5fb2f86f7c5774b76e28317a
Instruction ID: 981da8115c9b48803b9ad4d14fb071730699ec5304509786106cb108d2509734
Opcode Fuzzy Hash: bd14039b9dc44c48f3afba7226bd4a8f48c08aeb5fb2f86f7c5774b76e28317a
Instruction Fuzzy Hash: 8D71D4B2B08AC186D7659F26D04037D7BA1FB41FA8F0481B2DA8D0B6AACB3CD461C741

Function 00007FFE1A4544E4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A456E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4529EE), ref: 00007FFE1A456E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4545DB
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFE1A4545EB

Strings

csm, xrefs: 00007FFE1A45463D
csm, xrefs: 00007FFE1A45452E

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Frameabort$EmptyHandler3::StateUnwind
String ID: csm$csm
API String ID: 4108983575-3733052814
Opcode ID: 08ef0bffa0d8dc861c4a01b7d2fd628c67e896dc6c26123b9582640005c51e48
Instruction ID: de0bbe02d8b80d45672660b4dc0e76c3c97907b3f4d833729b3815f7139b15e7
Opcode Fuzzy Hash: 08ef0bffa0d8dc861c4a01b7d2fd628c67e896dc6c26123b9582640005c51e48
Instruction Fuzzy Hash: DC51A4B2B08A8586EB649B12914437976A1FB50FA4F1441F7DB4C4BBA6CF3CE571CB00

Function 00007FFE013879C8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFE013A383C), ref: 00007FFE01387A92
LCMapStringW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,00007FFE013A383C), ref: 00007FFE013CEB94

Strings

IsValidLocaleName, xrefs: 00007FFE013CEB2E
LCMapStringEx, xrefs: 00007FFE01387A88

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressProcString
String ID: IsValidLocaleName$LCMapStringEx
API String ID: 3874510993-3130311144
Opcode ID: 9b533e5280c762b994db7e40a40979f83a82ca94644ecff09b81028189333700
Instruction ID: 4ae85a88e5569bcc03867964fbff4fad312a8c16fabf7a0c9f043b33822090c6
Opcode Fuzzy Hash: 9b533e5280c762b994db7e40a40979f83a82ca94644ecff09b81028189333700
Instruction Fuzzy Hash: B941DF22B19B4282FB648B15E8107B973E1BB48BD8F055235ED5D5B7B4EF3CE9058740

Function 00007FFE013ED5C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 94libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFE013EF23F), ref: 00007FFE013ED648
CompareStringW.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00007FFE013EF23F), ref: 00007FFE013ED710

Strings

CompareStringEx, xrefs: 00007FFE013ED63E
AppPolicyGetThreadInitializationType, xrefs: 00007FFE013ED627

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressCompareProcString
String ID: AppPolicyGetThreadInitializationType$CompareStringEx
API String ID: 108076903-1200376162
Opcode ID: aa9721124bbc1be26fdb9ae6b67df0e1d7e2398948356b7dae4485f8b19b2e75
Instruction ID: b7b148b0f19cd61b3476b87588634da550e56c479a795ae764f4aa1ba3313026
Opcode Fuzzy Hash: aa9721124bbc1be26fdb9ae6b67df0e1d7e2398948356b7dae4485f8b19b2e75
Instruction Fuzzy Hash: 9131B531B09B4286EB54CB25E81076563E0FB58BE8F455135ED5D4B7B8DF3CE8458740

Function 00007FFE1A45B118 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1A45B172

Strings

%lf, xrefs: 00007FFE1A45B1AD, 00007FFE1A45B1E1, 00007FFE1A45B211

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: 7e0deb2cf17bd330c849068a4ca2fc9bc064bfcc9212df10860184869afe9d43
Instruction ID: d2b3330a5854bd68c2839003d70c3650593197a4c269079963081034022440b0
Opcode Fuzzy Hash: 7e0deb2cf17bd330c849068a4ca2fc9bc064bfcc9212df10860184869afe9d43
Instruction Fuzzy Hash: B331B7A1B0CF4685EA11EB13A8501BA7361BF55FA0F5481F7EA5E53771EE2CE162C700

Function 00007FFE013ED830 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 89libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,?,00007FFE013D80F1,?,?,?,?,?,?,?,00000000), ref: 00007FFE013ED8B2
GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(?,?,?,?,?,?,?,00007FFE013D80F1,?,?,?,?,?,?,?,00000000), ref: 00007FFE013ED960

Strings

GetDateFormatEx, xrefs: 00007FFE013ED8A8
RoInitialize, xrefs: 00007FFE013ED895

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressDateFormatProc
String ID: GetDateFormatEx$RoInitialize
API String ID: 2680382325-2816274727
Opcode ID: 9debc0c5372f8b20ce6dc845debd78ef40473b943a3ea9a30b28a14f0f99d8f9
Instruction ID: edd4fceb780c6654e149a1c97426c7fbd291097949f0a9e1744b9d2063977e34
Opcode Fuzzy Hash: 9debc0c5372f8b20ce6dc845debd78ef40473b943a3ea9a30b28a14f0f99d8f9
Instruction Fuzzy Hash: 67317E71B09B4282FB14CB16E81066567E1BB98BD4F0A5235EE5D5BBF8DF3CE8058740

Function 00007FFE013EDB6C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88libraryloadertimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,?,00007FFE013D8194,?,?,?,?,?,?,?,00000000), ref: 00007FFE013EDBEE
GetTimeFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(?,?,?,?,?,?,?,00007FFE013D8194,?,?,?,?,?,?,?,00000000), ref: 00007FFE013EDC96

Strings

RoInitialize, xrefs: 00007FFE013EDBD1
GetTimeFormatEx, xrefs: 00007FFE013EDBE4

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressFormatProcTime
String ID: GetTimeFormatEx$RoInitialize
API String ID: 3572143191-3078538569
Opcode ID: 08ba3db2cd023eb4a52b744bc0d50abaa24cb366c18270220956c9e46a07d6a8
Instruction ID: ff2fb3cab8e97004e0100bf96182d69c463449f725ade4a1bdee1742c6a1733b
Opcode Fuzzy Hash: 08ba3db2cd023eb4a52b744bc0d50abaa24cb366c18270220956c9e46a07d6a8
Instruction Fuzzy Hash: C3319E61B09B0286FB14CB56E81016567E1BB98BD4F0A4139EE5D5B7F8EF3CE401C700

Function 00007FFE01395BEC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01392DD6,?,?,?,00007FFE013D3A07,?,?,?,?,00007FFE0139720A,?,?,?), ref: 00007FFE01395C75
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE01392DD6,?,?,?,00007FFE013D3A07,?,?,?,?,00007FFE0139720A,?,?,?), ref: 00007FFE013D34D0

Strings

FlsSetValue, xrefs: 00007FFE01395C6B
LCMapStringEx, xrefs: 00007FFE013D3490

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressProcValue
String ID: FlsSetValue$LCMapStringEx
API String ID: 1414840956-3586097892
Opcode ID: c2bfd39ba120818d2612d53e507c27fabb8c75a6aa5377d5b8644cab998b21a8
Instruction ID: 5713712111903087ec9568489e93b6b757641530e3bada8fbdbfe1aad333cc40
Opcode Fuzzy Hash: c2bfd39ba120818d2612d53e507c27fabb8c75a6aa5377d5b8644cab998b21a8
Instruction Fuzzy Hash: 3021B161B1DA4242FB059B55FC501B523A1AF58BD8F05523AED6E4F7B4EF2CE9448240

Function 00007FFE0139DC00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE0139DB9B), ref: 00007FFE0139DC80
GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,00007FFE0139DB9B), ref: 00007FFE013D60CB

Strings

IsValidLocaleName, xrefs: 00007FFE013D6090
GetUserDefaultLocaleName, xrefs: 00007FFE0139DC76

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressDefaultProcUser
String ID: GetUserDefaultLocaleName$IsValidLocaleName
API String ID: 306211784-3812970866
Opcode ID: dcb265f1781f1b73115a2037d1729394b8a196afeee98dd2cf94c5db0d8f488f
Instruction ID: ee1b5a92b304bf9eda1487de94a18c92097f13b0dc24ebf89355f442672ed25f
Opcode Fuzzy Hash: dcb265f1781f1b73115a2037d1729394b8a196afeee98dd2cf94c5db0d8f488f
Instruction Fuzzy Hash: AE21AEA1A1DA4282FB489755F8612B613A1AF44BD8F065136EC2D5F7F4EE2CE9458340

Function 00007FFE013ED738 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE013ED164,?,?,?,?,00007FFE013969BB), ref: 00007FFE013ED7A9
TlsFree.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE013ED164,?,?,?,?,00007FFE013969BB), ref: 00007FFE013ED814

Strings

FlsFree, xrefs: 00007FFE013ED79F
LCMapStringEx, xrefs: 00007FFE013ED78C

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressFreeProc
String ID: FlsFree$LCMapStringEx
API String ID: 4110577592-1627765421
Opcode ID: e79c77a0240be8a567a5080c53d17f1f0626c61471528051b02ca36ec4fb2710
Instruction ID: 65556649f5e27fedba29546bb3cd68ad8545c935738ba81e89dd8e849c1ce378
Opcode Fuzzy Hash: e79c77a0240be8a567a5080c53d17f1f0626c61471528051b02ca36ec4fb2710
Instruction Fuzzy Hash: F2219261B1DB4242FB188B54E82017513E1AF587D8F059635ED2E4F7F8EF2CE9458340

Function 00007FFE01396F44 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01396906), ref: 00007FFE01396FBF
TlsAlloc.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE01396906), ref: 00007FFE01396FFF

Strings

FlsAlloc, xrefs: 00007FFE01396FB5
LCMapStringEx, xrefs: 00007FFE013D3662

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressAllocProc
String ID: FlsAlloc$LCMapStringEx
API String ID: 2924745751-1958574131
Opcode ID: 2a0f0c03515618c11b71a27955b96ad88552341b67fe2de0caf3d199cc0a7c3e
Instruction ID: 138214d0405fd374bd0c46228f89ab739d6feaed916bd17db887dafaafac22a9
Opcode Fuzzy Hash: 2a0f0c03515618c11b71a27955b96ad88552341b67fe2de0caf3d199cc0a7c3e
Instruction Fuzzy Hash: 6D21C5A1A1EA0341FB488B55F86157513A0AF447D8F456135ED2E1F7F4EE2CF8488340

Function 00007FFE01395890 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE013A185E,?,?,?,?,?,00007FFE013A1811), ref: 00007FFE013D3288
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE013A185E,?,?,?,?,?,00007FFE013A1811), ref: 00007FFE013D329E

Strings

FlsSetValue, xrefs: 00007FFE013D3294
LCMapStringEx, xrefs: 00007FFE013D3241

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressProcValue
String ID: FlsSetValue$LCMapStringEx
API String ID: 1414840956-3586097892
Opcode ID: 3818a68e7e2f3798cf4fe997117d6b6f00ca7b8d0f2e65211b2ae3421c2c64b4
Instruction ID: 93f44a73ed2f09938fa337fb9747117ab7d1d92f249e2702ebc11d0ddace9e16
Opcode Fuzzy Hash: 3818a68e7e2f3798cf4fe997117d6b6f00ca7b8d0f2e65211b2ae3421c2c64b4
Instruction Fuzzy Hash: F7214162F19B0242FB459B19F8501756392AF487A4F159639D97D4F7F4EE3CF8458300

Function 00007FFE01395900 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE013A1DEE,?,?,?,?,?,?,?,?,?,00007FFE013A1C89), ref: 00007FFE013D3329
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE013A1DEE,?,?,?,?,?,?,?,?,?,00007FFE013A1C89), ref: 00007FFE013D333F

Strings

FlsSetValue, xrefs: 00007FFE013D3335
LCMapStringEx, xrefs: 00007FFE013D32DF

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressProcValue
String ID: FlsSetValue$LCMapStringEx
API String ID: 1414840956-3586097892
Opcode ID: d5557e0cae6f55a059ba571ea4027650813cbd84ded42dbb11da8c47c6958741
Instruction ID: 74d1fcb5c6f15a19870321542ac0ed9c2904bc06016479481b3cbd892f210cc8
Opcode Fuzzy Hash: d5557e0cae6f55a059ba571ea4027650813cbd84ded42dbb11da8c47c6958741
Instruction Fuzzy Hash: 69216D61B1AB0242FB449B18FD502752391AF487B4F459639D97D4F7F8EE6CF8458301

Function 00007FFE01393360 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,00000000,00007FFE01392DA4,?,?,?,00007FFE013D3A07,?,?,?,?,00007FFE0139720A,?,?,?), ref: 00007FFE013933D9
TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FFE01392DA4,?,?,?,00007FFE013D3A07,?,?,?,?,00007FFE0139720A,?,?,?), ref: 00007FFE013CBC5E

Strings

LCMapStringEx, xrefs: 00007FFE013933B8
FlsGetValue, xrefs: 00007FFE013933CF

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressProcValue
String ID: FlsGetValue$LCMapStringEx
API String ID: 1414840956-552164261
Opcode ID: 057292a9f8eaf09dec05bf75a1bb2fd3eb35b4e290f2ce56d0f51df6153956ce
Instruction ID: 97f42da2910642c3866d3bfd482aae7308990f06df515aca495f94f5afca6813
Opcode Fuzzy Hash: 057292a9f8eaf09dec05bf75a1bb2fd3eb35b4e290f2ce56d0f51df6153956ce
Instruction Fuzzy Hash: 21216261B19B0282FF449B29E89017963A1AF487A4F069639D96D4F7F8DE3CF8498340

Function 00007FFE11515404 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE11513D80: PyErr_Format.PYTHON312 ref: 00007FFE11514102

PySys_Audit.PYTHON312 ref: 00007FFE1151545C

Part of subcall function 00007FFE1151442C: PyEval_SaveThread.PYTHON312 ref: 00007FFE1151444A
Part of subcall function 00007FFE1151442C: connect.WS2_32 ref: 00007FFE1151445D
Part of subcall function 00007FFE1151442C: PyEval_RestoreThread.PYTHON312 ref: 00007FFE11514468
Part of subcall function 00007FFE1151442C: WSAGetLastError.WS2_32 ref: 00007FFE11514476
Part of subcall function 00007FFE1151442C: WSAGetLastError.WS2_32 ref: 00007FFE11514482
Part of subcall function 00007FFE1151442C: PyErr_CheckSignals.PYTHON312 ref: 00007FFE1151448F
Part of subcall function 00007FFE1151442C: WSASetLastError.WS2_32 ref: 00007FFE115144CC

PyLong_FromLong.PYTHON312 ref: 00007FFE11515481

Strings

socket.connect, xrefs: 00007FFE11515455
connect_ex, xrefs: 00007FFE11515423

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$Err_Eval_Thread$AuditCheckFormatFromLongLong_RestoreSaveSignalsSys_connect
String ID: connect_ex$socket.connect
API String ID: 3879675179-935070752
Opcode ID: 2962bc6f7dbe70797a4ee8eecfeeb2ff851f713150ec20ace90f4a2f1302f801
Instruction ID: b8a40abbdf117a20a824b1664fcc4d9badddb70ac4cf05c3b19bcd1ad6cde58c
Opcode Fuzzy Hash: 2962bc6f7dbe70797a4ee8eecfeeb2ff851f713150ec20ace90f4a2f1302f801
Instruction Fuzzy Hash: E4118E21B1CE8285EB628BA3F4107AA63A9FF447A4F440072DA4D47A75EF7CE004C740

Function 00007FFE1A452A50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A456E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4529EE), ref: 00007FFE1A456E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452A8E

Strings

MOC, xrefs: 00007FFE1A452A68
csm, xrefs: 00007FFE1A452A70
RCC, xrefs: 00007FFE1A452A60

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: 3ab94ae7472f91afbfb2fa40e8eaefdcfa6935c471aaf11af4776549d32657f7
Instruction ID: bf05f5ed05f654c924678f930fc850e68dc2489998943898e4d87e2a05e401aa
Opcode Fuzzy Hash: 3ab94ae7472f91afbfb2fa40e8eaefdcfa6935c471aaf11af4776549d32657f7
Instruction Fuzzy Hash: EBF03C72A18A0686E7A47B63E18107D7664EF48F61F1950F3EB4806262CF7CE8B0C701

Function 00007FFE11EB12DC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312(?,?,00000006,00007FFE11EB0138), ref: 00007FFE11EB12E9
PyErr_Occurred.PYTHON312(?,?,00000006,00007FFE11EB0138), ref: 00007FFE11EB12F2
PyErr_SetString.PYTHON312(?,?,00000006,00007FFE11EB0138), ref: 00007FFE11EB5C13

Strings

Value too large for uint32_t type, xrefs: 00007FFE11EB5C09

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for uint32_t type
API String ID: 944333170-1712686559
Opcode ID: 04c9a14db9ad32f61774afc0bccaea88f7c247a1f103ee7b9b23db3c104f223f
Instruction ID: ec8f4f4d5cf12ddcc45dc70c9ef640308d6cf600d920af1cdab942a1c7a7c4cb
Opcode Fuzzy Hash: 04c9a14db9ad32f61774afc0bccaea88f7c247a1f103ee7b9b23db3c104f223f
Instruction Fuzzy Hash: 8CF08220B09E43CAEB004FA7FC8463A23A8BF48BA5F044076DA0D46730EE3CE4948304

Function 00007FFE11EB61C8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE11EB61D5
PyErr_Occurred.PYTHON312 ref: 00007FFE11EB61DE
PyErr_SetString.PYTHON312 ref: 00007FFE11EB6206

Strings

Value too large for lzma_mode type, xrefs: 00007FFE11EB61FC

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for lzma_mode type
API String ID: 944333170-1290617251
Opcode ID: 0e76b3866fc3bcb7a5649b9497d3946265030f1ee6d5e33ec6cce759dd01f5a6
Instruction ID: b7ecc6f21435a3bb9904c8801e4707f71e98c94c2da466f29bc17473cd92b711
Opcode Fuzzy Hash: 0e76b3866fc3bcb7a5649b9497d3946265030f1ee6d5e33ec6cce759dd01f5a6
Instruction Fuzzy Hash: BFF05821A09E0389EF104F93FC8053A63A8BF48FA0F0840B6CA0E06374CE3CE4948708

Function 00007FFE11EB6170 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON312 ref: 00007FFE11EB617D
PyErr_Occurred.PYTHON312 ref: 00007FFE11EB6186
PyErr_SetString.PYTHON312 ref: 00007FFE11EB61AE

Strings

Value too large for lzma_match_finder type, xrefs: 00007FFE11EB61A4

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for lzma_match_finder type
API String ID: 944333170-1161044407
Opcode ID: b7c9e5cd85fe7e041b9e1837019c8943bb6b93b4fd8f7ff26e19bffd3d262c1f
Instruction ID: b37afb9336e5ac6320bf84797c7cb89be9d207c07a15a25b2e28a374aefed169
Opcode Fuzzy Hash: b7c9e5cd85fe7e041b9e1837019c8943bb6b93b4fd8f7ff26e19bffd3d262c1f
Instruction Fuzzy Hash: 37F05E21B08E0285EB144F93ED8453A23A8BF48FA4F084076CA0D0A371DE3CE4848704

Function 00007FFE11516738 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON312 ref: 00007FFE1151675C
PyErr_SetString.PYTHON312 ref: 00007FFE11516781

Strings

<socket object, fd=%ld, family=%d, type=%d, proto=%d>, xrefs: 00007FFE11516751
no printf formatter to display the socket descriptor in decimal, xrefs: 00007FFE11516777

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Err_FormatFromStringUnicode_
String ID: <socket object, fd=%ld, family=%d, type=%d, proto=%d>$no printf formatter to display the socket descriptor in decimal
API String ID: 1884982852-285600062
Opcode ID: ff9266a9ee1f81eaf94e791bbc0501b2ca49c8d8a91491c8603a5e96e663f622
Instruction ID: 1c84b332f755d0c33d88c97a0e30f30cb2da42e592d7cf8bdfc07ca3b84ee665
Opcode Fuzzy Hash: ff9266a9ee1f81eaf94e791bbc0501b2ca49c8d8a91491c8603a5e96e663f622
Instruction Fuzzy Hash: 05F05E74E0890282EB119B2AD84047833B6FB48BB8FA04371C93D472F0EE6DE406C710

Function 00007FFE01393220 Relevance: 6.3, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0139322F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0139327E
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01393299
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE013932B1
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01393321

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 6a3ee440ea5db79d3e7f622a770cbd6c6d832af213acb4bb2e0b024190d58d6b
Instruction ID: 10409dc8ad38efb3c8fbcf24796f114239efaf30079aa1719ef8225643f09977
Opcode Fuzzy Hash: 6a3ee440ea5db79d3e7f622a770cbd6c6d832af213acb4bb2e0b024190d58d6b
Instruction Fuzzy Hash: 5D31B220F0D64386FB54AB31E99117D22A5BF447A8F050635E96E0FBF6DE2CF8458700

Function 00007FFE013930C0 Relevance: 6.3, APIs: 5, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FFE01382468,?,?,00000000,?,00000000,00007FFE01382036), ref: 00007FFE013930CF
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FFE01382468,?,?,00000000,?,00000000,00007FFE01382036), ref: 00007FFE0139311E
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FFE01382468,?,?,00000000,?,00000000,00007FFE01382036), ref: 00007FFE01393139
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FFE01382468,?,?,00000000,?,00000000,00007FFE01382036), ref: 00007FFE01393151
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FFE01382468,?,?,00000000,?,00000000,00007FFE01382036), ref: 00007FFE013931BD

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: d479305a78ada1b5cab12f65b0e77c369e7f84cb1d83b1e8908b084dacaa8c0d
Instruction ID: 64fc92bcfcd8895786c00845f50769d06ad6d5482e29eb4d18b4069ec3bd63f2
Opcode Fuzzy Hash: d479305a78ada1b5cab12f65b0e77c369e7f84cb1d83b1e8908b084dacaa8c0d
Instruction Fuzzy Hash: AD318D60E0DA4386FB58BB34E89117D22A5BF447A8F050635E96E0FBF6DE2CF8448701

Function 00007FFE01392C30 Relevance: 6.3, APIs: 5, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000001,00007FFE01426105), ref: 00007FFE01392C44
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000001,00007FFE01426105), ref: 00007FFE01392C93
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000001,00007FFE01426105), ref: 00007FFE01392CA9
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000001,00007FFE01426105), ref: 00007FFE01392CC1
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000001,00007FFE01426105), ref: 00007FFE01392D2A

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 0d77692d69ce860c7b8ecdc2c5ad5fe4224388b8a7ecdc0a9e9ce8307b03d879
Instruction ID: 3d3de0b0583a61c89b17c3e9a0a73a0ad625722be88dee062cce30bc6610a3ff
Opcode Fuzzy Hash: 0d77692d69ce860c7b8ecdc2c5ad5fe4224388b8a7ecdc0a9e9ce8307b03d879
Instruction Fuzzy Hash: 0831A420F0DA4386FB55AB34E99117E2265AF447A4F050635E97E0F7F6DE2CF8458740

Function 00007FFE01392B00 Relevance: 6.3, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01392B14
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01392B63
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01392B79
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01392B91
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01392BFA

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: cf530fa63458d16339cc321344d5bae331de74766023e2588c3b19cc33c82e12
Instruction ID: 30d7100c65d9c969e75c7251c0865f2492ddf5db5291fe11e4be6ad8d1eef436
Opcode Fuzzy Hash: cf530fa63458d16339cc321344d5bae331de74766023e2588c3b19cc33c82e12
Instruction Fuzzy Hash: B731A620F0DA4386FB54AB34E59117E22A5BF447A4F060634E96E0FBF6DE2CF8458741

Function 00007FFE01392F80 Relevance: 6.3, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01392F8F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01392FDE
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01392FF9
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01393011
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0139307D

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 74ee3b7255af2df80603282a41a074ca34c48f3162f0bfb4f17de7617d99687e
Instruction ID: 43daf31f854dcc7a961b51c1ad428316649192f8417589fa7c7e39c8a6b74d1a
Opcode Fuzzy Hash: 74ee3b7255af2df80603282a41a074ca34c48f3162f0bfb4f17de7617d99687e
Instruction Fuzzy Hash: 87317E20E0CA4386FB58AB35E99517D22A5BF447A4F060635E96F0FBF6DE2CF8458700

Function 00007FFE01392E40 Relevance: 6.3, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01392E54
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01392EA3
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01392EB9
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01392ED1
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01392F3E

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 1f4c3af6c73bf2d8102ddb41ecf63b91324e2d241ec9f17bd0c65061d32c1bbb
Instruction ID: ce8ff9d4fe305a2850ba65578c0a3a4b62a93efc1ed5c091db802679e3d01cfe
Opcode Fuzzy Hash: 1f4c3af6c73bf2d8102ddb41ecf63b91324e2d241ec9f17bd0c65061d32c1bbb
Instruction Fuzzy Hash: 5F31A620F0DA4386FB58A731E99157E2255AF447E4F050634E96E0F7F6DE2CF8498700

Function 00007FFE0139EC70 Relevance: 6.3, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0139EA46), ref: 00007FFE0139EC90
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0139EA46), ref: 00007FFE0139ECE6
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0139EA46), ref: 00007FFE0139ED5C
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0139EA46), ref: 00007FFE0139ED72
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0139EA46), ref: 00007FFE0139ED8B

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 13c8296e469cbfe90923225cb70e1d4439e8bc9fe74f841b58539c49c5e0734b
Instruction ID: efd9c818e3cae06659b9cf909457081845f7fa1ac9df603ae1c6cb9a623c0977
Opcode Fuzzy Hash: 13c8296e469cbfe90923225cb70e1d4439e8bc9fe74f841b58539c49c5e0734b
Instruction Fuzzy Hash: 4C31A122A19B8682EB54CF15E8442796794FB94BE4F1A1235D99E0B3F4DFBCE481C700

Function 00007FFE1A45A638 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE1A45CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CE4D
Part of subcall function 00007FFE1A45CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CE86
Part of subcall function 00007FFE1A45CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45D1B1

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A793
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A7F2
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A824
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A834

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: cc076bc81e8f2d48ba6aefa04368e4e4f2bc5c7ef048a26b3748b4f62f7846b0
Instruction ID: e2f86aca1f601f7042d61afb5962c07a50ea380ada2080909daca55c9a1d71c2
Opcode Fuzzy Hash: cc076bc81e8f2d48ba6aefa04368e4e4f2bc5c7ef048a26b3748b4f62f7846b0
Instruction Fuzzy Hash: FA914BA2F08F5289F7119B66D8443BC37B1BB04B68F5440F7DA4D176A5DF78A8A6C340

Function 00007FFE01395A30 Relevance: 6.1, APIs: 4, Instructions: 129COMMON

Download Yara Rule

APIs

__security_init_cookie.LIBCMT ref: 00007FFE01395A58
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01395A8F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01395AE1

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$__security_init_cookie
String ID:
API String ID: 2222513578-0
Opcode ID: 80bf6847748f331f579bb3edf7f785c7f356480193b5a2c45c96b1f7695188f7
Instruction ID: 9bd60ec75fd41db3507a9687600ed318b8e474b41d2ccce3d86538583b4a3ced
Opcode Fuzzy Hash: 80bf6847748f331f579bb3edf7f785c7f356480193b5a2c45c96b1f7695188f7
Instruction Fuzzy Hash: CF51E520F0D34342FB6B6724A99117D6295AF497A4F1A4636D82E4F7F6DE6CFC848B00

Function 00007FFE11EA8120 Relevance: 6.1, APIs: 4, Instructions: 102threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON312(?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EA8155

Part of subcall function 00007FFE11EB23C0: PyBytes_FromStringAndSize.PYTHON312(?,?,?,00007FFE11EA816F,?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EB23F7
Part of subcall function 00007FFE11EB23C0: PyList_New.PYTHON312(?,?,?,00007FFE11EA816F,?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EB240A

PyEval_SaveThread.PYTHON312(?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EA817C
PyEval_RestoreThread.PYTHON312(?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EA8195
_Py_Dealloc.PYTHON312(?,?,?,00000000,?,?,?,00007FFE11EA7DD1), ref: 00007FFE11EA8255

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: Eval_Thread$Bytes_DeallocFromList_ModuleRestoreSaveSizeStateStringType_
String ID:
API String ID: 2935988267-0
Opcode ID: b031da5807da25ad0a3ba3cb35cc5f0a1efe88732de7bf57d45a2b66c52b58f5
Instruction ID: 590d110a0fcdbc5fd32fe2d729d58063c9f3abe5e49cd5d6db2b4fcad3b42ed3
Opcode Fuzzy Hash: b031da5807da25ad0a3ba3cb35cc5f0a1efe88732de7bf57d45a2b66c52b58f5
Instruction Fuzzy Hash: F841A422A09E4285EB248BA6AC409BB23A8FF88BA9F140176DA0D43764DF3CE441C350

Function 00007FFE1A45D274 Relevance: 6.1, APIs: 4, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE1A45ED94: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A45EDEE

Part of subcall function 00007FFE1A45CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CE4D
Part of subcall function 00007FFE1A45CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CE86
Part of subcall function 00007FFE1A45CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45D1B1

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45D2F4
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45D303
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45D380
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45D38F

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID:
API String ID: 3863519203-0
Opcode ID: 57265f9aaea93611d8ae4b0edf9f43af56394ecd72ecd9aef4b3b93798ee479d
Instruction ID: 9e8a31f296105f5cfc6c94cd492f7fb90470b07ebc3ddefbf57ebb7c5ca3f9eb
Opcode Fuzzy Hash: 57265f9aaea93611d8ae4b0edf9f43af56394ecd72ecd9aef4b3b93798ee479d
Instruction Fuzzy Hash: 104166B2B08B4189FB01DF66D8403BC37B0BB48B68F9484B6DA8D57769DF789495C350

Function 00007FFE1151454C Relevance: 6.1, APIs: 4, Instructions: 75threadtimeCOMMON

Download Yara Rule

APIs

_PyTime_AsTimeval_clamp.PYTHON312 ref: 00007FFE115145A1
PyEval_SaveThread.PYTHON312 ref: 00007FFE115145E0
select.WS2_32 ref: 00007FFE11514614
PyEval_RestoreThread.PYTHON312 ref: 00007FFE1151461F

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveTime_Timeval_clampselect
String ID:
API String ID: 3905867726-0
Opcode ID: 132c99158f9a3ea89ea502ecae564c9cdf5c0a75580648827cc09a477b3f3839
Instruction ID: 27ffabe8ba59d7c200dcd59e1ff1cfb993009a7db9da03d7b9de3f2463d8fae7
Opcode Fuzzy Hash: 132c99158f9a3ea89ea502ecae564c9cdf5c0a75580648827cc09a477b3f3839
Instruction Fuzzy Hash: 6131D662B08F8186E7618F26E8406A667A5FB897B8F511635DA6D43BB4DF3CD405C700

Function 00007FFE013A1150 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE013A11EC: GetModuleHandleExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE013A1178), ref: 00007FFE013A1230

CreateThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FFE013A11A1
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE013D729F

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: CreateErrorHandleLastModuleThread
String ID:
API String ID: 182981130-0
Opcode ID: a5b4c46c7fbfc90a5948d51b1be21cada93777eb68ff9d6607fe3b31c7df1402
Instruction ID: 035af6d704e68e82e3f34a256b9039cb961ac4b8a18ef572e492361a27e16302
Opcode Fuzzy Hash: a5b4c46c7fbfc90a5948d51b1be21cada93777eb68ff9d6607fe3b31c7df1402
Instruction Fuzzy Hash: 99219D25B0EB4282FF14DFA5E85007963A4BF88B84F9A0531EE4E4B7B5DE7CE8008740

Function 00007FFE01423B50 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FFE01423CD2,?,?,?,?,00007FFE013D4F23,?,?,?,00007FFE0139A756,?,?,?), ref: 00007FFE01423B8A
FlushFileBuffers.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FFE01423CD2,?,?,?,?,00007FFE013D4F23,?,?,?,00007FFE0139A756,?,?,?), ref: 00007FFE01423BBB

Part of subcall function 00007FFE0139F1F0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE01397594,?,?,?,00007FFE01397217,?,?,?,00007FFE0139A5D3,?,?,?,00007FFE0139A756), ref: 00007FFE0139F1FA
Part of subcall function 00007FFE0139F1F0: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE01397594,?,?,?,00007FFE01397217,?,?,?,00007FFE0139A5D3,?,?,?,00007FFE0139A756), ref: 00007FFE0139F240

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE01423CD2,?,?,?,?,00007FFE013D4F23,?,?,?,00007FFE0139A756,?,?,?), ref: 00007FFE01423BCF
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FFE01423CD2,?,?,?,?,00007FFE013D4F23,?,?,?,00007FFE0139A756,?,?,?), ref: 00007FFE01423BFE

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$CriticalSection$BuffersEnterFileFlushLeave
String ID:
API String ID: 1312186065-0
Opcode ID: dda621dce4546ef8d4b62c8d56ae609822c4479e3767a83f07bbc17b3138389e
Instruction ID: 79a717c5422c7b8548ac1b655bc1bbd9fb485ede31d33d466a326220b965d882
Opcode Fuzzy Hash: dda621dce4546ef8d4b62c8d56ae609822c4479e3767a83f07bbc17b3138389e
Instruction Fuzzy Hash: 6421CD72A25F8A82DF10DF19E4941696361FB98F88B845231EB4E4B3B9DF3CE094C300

Function 00007FFE11515684 Relevance: 6.0, APIs: 4, Instructions: 43threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE11514198: PyErr_SetString.PYTHON312 ref: 00007FFE115141DB

memset.VCRUNTIME140 ref: 00007FFE115156D0
PyEval_SaveThread.PYTHON312 ref: 00007FFE115156D5
getpeername.WS2_32 ref: 00007FFE115156EC
PyEval_RestoreThread.PYTHON312 ref: 00007FFE115156F7

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSaveStringgetpeernamememset
String ID:
API String ID: 1387529023-0
Opcode ID: d333ced5451af9c47f1d40d52a0f7a17ea8ca670dc3e75ab6e25fc5b6f2c5c02
Instruction ID: b6cf0e5c980a7e57486871ef023bfb9fa41b1157832ff66d7251b9aa8a9c9b64
Opcode Fuzzy Hash: d333ced5451af9c47f1d40d52a0f7a17ea8ca670dc3e75ab6e25fc5b6f2c5c02
Instruction Fuzzy Hash: 38112166A1CFC2C2EB319B62F0413AA6366FB88794F445172DA8E17A79DF7CE145C700

Function 00007FFE11515744 Relevance: 6.0, APIs: 4, Instructions: 43threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE11514198: PyErr_SetString.PYTHON312 ref: 00007FFE115141DB

memset.VCRUNTIME140 ref: 00007FFE11515790
PyEval_SaveThread.PYTHON312 ref: 00007FFE11515795
getsockname.WS2_32 ref: 00007FFE115157AC
PyEval_RestoreThread.PYTHON312 ref: 00007FFE115157B7

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSaveStringgetsocknamememset
String ID:
API String ID: 772546412-0
Opcode ID: 331c56e1a5d5b6d9b8728b9afc51924fc515e080c38d2058f0a06873dd37f908
Instruction ID: e852423ad8f67c85e1ad136eaeadf7efb184d1195b3343bd399917e3738ec9cb
Opcode Fuzzy Hash: 331c56e1a5d5b6d9b8728b9afc51924fc515e080c38d2058f0a06873dd37f908
Instruction Fuzzy Hash: BA112166A1CFC2C2EB319B62F0413AA6366FB887A4F045172DA8D17A75DF7CE145C700

Function 00007FFE11EA748C Relevance: 6.0, APIs: 4, Instructions: 40threadCOMMON

Download Yara Rule

APIs

PyThread_free_lock.PYTHON312 ref: 00007FFE11EA74D9
PyMem_Free.PYTHON312 ref: 00007FFE11EA7506
_Py_Dealloc.PYTHON312 ref: 00007FFE11EA750E

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: DeallocFreeMem_Thread_free_lock
String ID:
API String ID: 2783890233-0
Opcode ID: 241b2464845ba90ef22225749f9bdab0b32c8749fa1bfe864e75294d390d78d3
Instruction ID: ce5b56e4389db3127e1b435601dcc6b09f64e2f6a97fb27607b2a9a02bb35962
Opcode Fuzzy Hash: 241b2464845ba90ef22225749f9bdab0b32c8749fa1bfe864e75294d390d78d3
Instruction Fuzzy Hash: 6F117922E49D4286EB59CFA3FD5437A33A8FF44BA5F1840B1C60F466B08F2DA4A5C300

Function 00007FFE130C2F84 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE130C2FB0
GetCurrentThreadId.KERNEL32 ref: 00007FFE130C2FBE
GetCurrentProcessId.KERNEL32 ref: 00007FFE130C2FCA
QueryPerformanceCounter.KERNEL32 ref: 00007FFE130C2FDA

Memory Dump Source

Source File: 00000001.00000002.2938510031.00007FFE130C1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2938494029.00007FFE130C0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938526688.00007FFE130C4000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938542624.00007FFE130C6000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000001.00000002.2938561193.00007FFE130C7000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_3OQL58yflv.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 82b165f8251c8205f418dcf9eff9a9c6bd82e1a31987b624f3b9e3a573322e70
Instruction ID: 84c66c5072c7452c6b788b4f13cccb3efa03707c7a9b5dd4712229c45a14747d
Opcode Fuzzy Hash: 82b165f8251c8205f418dcf9eff9a9c6bd82e1a31987b624f3b9e3a573322e70
Instruction Fuzzy Hash: 7B112E22B54F0589EB00CF61E8542B933B4F729768F950DB1DA6DA67B4DF78E1988340

Function 00007FFE11EB383C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE11EB3868
GetCurrentThreadId.KERNEL32 ref: 00007FFE11EB3876
GetCurrentProcessId.KERNEL32 ref: 00007FFE11EB3882
QueryPerformanceCounter.KERNEL32 ref: 00007FFE11EB3892

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9f45f47aa0c574cbc5e61ae9618a0ea9e430d20d27403f3b7bab5d5648c5a6ee
Instruction ID: 2c161a4c04e577f29da5e604a2615c8ffb0035af6c73befc177f5d8705e928bc
Opcode Fuzzy Hash: 9f45f47aa0c574cbc5e61ae9618a0ea9e430d20d27403f3b7bab5d5648c5a6ee
Instruction Fuzzy Hash: 1D112E26B54F0189EB00CFA1EC552B933B8F719768F441D35DA6D467A4DF7CE1588340

Function 00007FFE1A4609FC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE1A460A28
GetCurrentThreadId.KERNEL32 ref: 00007FFE1A460A36
GetCurrentProcessId.KERNEL32 ref: 00007FFE1A460A42
QueryPerformanceCounter.KERNEL32 ref: 00007FFE1A460A52

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 74344bb322e65ea4bb1ed5ded81f371800f489492d84809563666ba838173471
Instruction ID: 33dffdaf724ecdefb08a3f1d2a2de64897ed55664a948e8fbf907ee1024d40a7
Opcode Fuzzy Hash: 74344bb322e65ea4bb1ed5ded81f371800f489492d84809563666ba838173471
Instruction Fuzzy Hash: 7E113022B18F418AEB00CF61E8542B833B4F759B68F440E72DA6D477A8DF7CE1688340

Function 00007FFE1330166C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE13301698
GetCurrentThreadId.KERNEL32 ref: 00007FFE133016A6
GetCurrentProcessId.KERNEL32 ref: 00007FFE133016B2
QueryPerformanceCounter.KERNEL32 ref: 00007FFE133016C2

Memory Dump Source

Source File: 00000001.00000002.2938594897.00007FFE13301000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2938578259.00007FFE13300000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938612939.00007FFE13303000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938629391.00007FFE13305000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.2938646123.00007FFE13306000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_3OQL58yflv.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9c853473a29be10e18c41db3475ffbe93156bbd5e1d3e33e9fbd1863b34337d1
Instruction ID: d96bc2daddb5156514f4dd775e68ffbd56cc25b73134a83150d14bfa2986ce0b
Opcode Fuzzy Hash: 9c853473a29be10e18c41db3475ffbe93156bbd5e1d3e33e9fbd1863b34337d1
Instruction Fuzzy Hash: 53113026B19F018DEB00CF61E8542BD33A4FB29768F441D31DA6D567A4DF7CD1588344

Function 00007FFE11512F4C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFE11512F78
GetCurrentThreadId.KERNEL32 ref: 00007FFE11512F86
GetCurrentProcessId.KERNEL32 ref: 00007FFE11512F92
QueryPerformanceCounter.KERNEL32 ref: 00007FFE11512FA2

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c078feb60dcaa47ac6474724f16ee69659723c0569e8a68c8bd7eb9cde73f689
Instruction ID: 16a0c57033ba829f9770567e39c710266c34a71d9d45145644669ee329a2333b
Opcode Fuzzy Hash: c078feb60dcaa47ac6474724f16ee69659723c0569e8a68c8bd7eb9cde73f689
Instruction Fuzzy Hash: 78111826B14F018AEB00DB71E8952B933B8FB59768F441A31DA6D867B4EF7CD1988340

Function 00007FFE0139C5BC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE01392900: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013F2861), ref: 00007FFE0139290A
Part of subcall function 00007FFE01392900: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFE013F2861), ref: 00007FFE01392950

GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,00000092,?,?,?,?,00007FFE0138FA5B), ref: 00007FFE0139C661
IsValidCodePage.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FFE0139C67F

Strings

utf8, xrefs: 00007FFE013D5D60

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: a1b9c38fbbb88349f7fd5a6c21530e343503cacf08c1f65a8fa259db4b71df2e
Instruction ID: f35d0b0a40abcc3fdf6a8b7cb306fa25dd0c6be949b72903cce9ad28c52a3a58
Opcode Fuzzy Hash: a1b9c38fbbb88349f7fd5a6c21530e343503cacf08c1f65a8fa259db4b71df2e
Instruction Fuzzy Hash: D1918B22A0868786FB609F21D8546BE26A8BF44B98F465131DE4D5F6B1EF3CE946C340

Function 00007FFE1A45F670 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE1A45F732
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFE1A45F435), ref: 00007FFE1A45F78C

Strings

csm, xrefs: 00007FFE1A45F719

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind
String ID: csm
API String ID: 451473138-1018135373
Opcode ID: 88d75f8372be57577a220e465c4aa8d65e851ebfefcdd899ecde71752cd89d28
Instruction ID: 3e254eb058274db80f329d4f6bdb0b1a4564a01dbbbef0ed088735ea23cff000
Opcode Fuzzy Hash: 88d75f8372be57577a220e465c4aa8d65e851ebfefcdd899ecde71752cd89d28
Instruction Fuzzy Hash: 7A51D572B19A028ADB18EB17E444A7C73A1EB44FA4F1081F6DA5D437A8DF3DE861C701

Function 00007FFE013AA400 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FFE013AA68B

Strings

fmod, xrefs: 00007FFE013AA65C
!, xrefs: 00007FFE013AA67B

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: _handle_error
String ID: !$fmod
API String ID: 1757819995-3213614193
Opcode ID: 9594e93d67916e3089a32797a5ef1f6c1e779e4e1450da6f11e5191fcb85c646
Instruction ID: 157663a3a506619888bb59ec9e235c9158447f324dd77ff164e73c0c32d7494b
Opcode Fuzzy Hash: 9594e93d67916e3089a32797a5ef1f6c1e779e4e1450da6f11e5191fcb85c646
Instruction Fuzzy Hash: 8351E812D2DF8189E3635B7190157B5B798AFA23C0F829332E94E3A5B1DF2DB1138604

Function 00007FFE1A454E40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A456E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4529EE), ref: 00007FFE1A456E56

_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFE1A454F16
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A454F74

Strings

csm, xrefs: 00007FFE1A45501A

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: abort$CreateFrameInfo
String ID: csm
API String ID: 2697087660-1018135373
Opcode ID: a8b8ee24cb783e7d293a6e1db454b28b1bfc46eb23a73e5049af87221528bbc6
Instruction ID: 6c548b89e410d91d6acf8a4d69b70324756b5b1b9ef40ebb5ab467b027ff0735
Opcode Fuzzy Hash: a8b8ee24cb783e7d293a6e1db454b28b1bfc46eb23a73e5049af87221528bbc6
Instruction Fuzzy Hash: 1F511C73719B4186D660AB26E44027E77A4FB89FA1F1401B6EB8D47B65CF3CE461CB01

Function 00007FFE0139C3E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE0138D610: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FFE01392DE9,?,?,?,00007FFE013D3A07,?,?,?,?,00007FFE0139720A,?,?,?), ref: 00007FFE0138D658

InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FFE0139ED3E,?,?,?,?,?,00007FFE0139EA46), ref: 00007FFE013D5BFA
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,00007FFE0139ED3E,?,?,?,?,?,00007FFE0139EA46), ref: 00007FFE013D5C10

Strings

InitializeCriticalSectionEx, xrefs: 00007FFE013D5C06

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressAllocCountCriticalHeapInitializeProcSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 1188775705-3084827643
Opcode ID: c0b4ad56a02261d26642c04bf8cb09cf74c2ff9631d4101eaa7aa1f9bd0b5d53
Instruction ID: 3d95867234debb44ec80e18553341e8901c763c94cf8334bc47256db9b86de1d
Opcode Fuzzy Hash: c0b4ad56a02261d26642c04bf8cb09cf74c2ff9631d4101eaa7aa1f9bd0b5d53
Instruction Fuzzy Hash: EF41DE22B19B4282EB159B59E85027833A0FB457A4F855735EAAD5B7F4DF3CF816C300

Function 00007FFE01426500 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99fileCOMMON

Download Yara Rule

APIs

WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFE0142660F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01426634

Strings

U, xrefs: 00007FFE014265B8

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: d8b304d1ba259a88f3b7490107207db4540db0dc939a48cc8eaea431c50e3fb6
Instruction ID: 1b49a0a2e67f091003677a582a8a1a9fe963e3cb8fbd8915f8c34d8bb03e5e73
Opcode Fuzzy Hash: d8b304d1ba259a88f3b7490107207db4540db0dc939a48cc8eaea431c50e3fb6
Instruction Fuzzy Hash: 4441B572B19A4185EB208F65E4443ADB7A1FB98B94F814131EE4D8B7B8DF3CD481CB41

Function 00007FFE0EA72AF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE0EA72B82

Strings

src/AESNI.c, xrefs: 00007FFE0EA72B74
(idx>=1) && (idx<=10), xrefs: 00007FFE0EA72B7B

Memory Dump Source

Source File: 00000001.00000002.2936942642.00007FFE0EA71000.00000020.00000001.01000000.00000023.sdmp, Offset: 00007FFE0EA70000, based on PE: true

Associated: 00000001.00000002.2936928583.00007FFE0EA70000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936956825.00007FFE0EA73000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936970557.00007FFE0EA74000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 00000001.00000002.2936984077.00007FFE0EA75000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe0ea70000_3OQL58yflv.jbxd

Similarity

API ID: _wassert
String ID: (idx>=1) && (idx<=10)$src/AESNI.c
API String ID: 3234217646-2495715787
Opcode ID: f34cea9cfd06ae8d0bacecc527501edc0e611be2f02bd286901079fb247b3b81
Instruction ID: b528da3bf28abb6d3c10ff17910d818049935ddb0a2be945f4ec60f18ec61905
Opcode Fuzzy Hash: f34cea9cfd06ae8d0bacecc527501edc0e611be2f02bd286901079fb247b3b81
Instruction Fuzzy Hash: 0621327390D3C14BD7028F3594990987FB0EB96B50B9AC1BAC2D483612EA9C98CBC711

Function 00007FFE013C1620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FFE013C1675
InterlockedPushEntrySList.API-MS-WIN-CORE-INTERLOCKED-L1-1-0(?,?,?,?,?,?,?,00007FFE01396EB5), ref: 00007FFE013C16F7

Strings

, xrefs: 00007FFE013C1698

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: EntryInterlockedListNamePush__un
String ID:
API String ID: 524438517-3916222277
Opcode ID: e41d497225cde52b0ab13a8d295de25a175a81526d6415c0a7e7937b6b353a80
Instruction ID: 8893ff833906adabd76a715271ffc9daadb2c230648765201fc0a43a5c61b946
Opcode Fuzzy Hash: e41d497225cde52b0ab13a8d295de25a175a81526d6415c0a7e7937b6b353a80
Instruction Fuzzy Hash: 97312822B19B5690FB15DF2694085B92394FF08FE4F5A8632DE2D0B3A5DE3DD842C340

Function 00007FFE0138173C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,00000000,?,00007FFE01381718), ref: 00007FFE013817A3

Strings

IsValidLocaleName, xrefs: 00007FFE013CCF44
EnumSystemLocalesEx, xrefs: 00007FFE01381799

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressProc
String ID: EnumSystemLocalesEx$IsValidLocaleName
API String ID: 190572456-1098237698
Opcode ID: ffccf2b07cb19d4b7826764400d7a5f246e3ffa5e570d01e79c8653424bcd810
Instruction ID: c3c1ccdc1dfcad5ef09b9622f33a2859643f52bb6bafc1c02e7c686e1e1cbd19
Opcode Fuzzy Hash: ffccf2b07cb19d4b7826764400d7a5f246e3ffa5e570d01e79c8653424bcd810
Instruction Fuzzy Hash: 78318B72A09B0282FB049B15E8506B963A1AF55794F465136EE5C4F7B4EF7CF409C780

Function 00007FFE013B8BD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_handle_errorf.LIBCMT ref: 00007FFE013B8D42

Strings

", xrefs: 00007FFE013B8CED
powf, xrefs: 00007FFE013B8D3B

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: _handle_errorf
String ID: "$powf
API String ID: 2315412904-603753351
Opcode ID: 7d9049be05b4b7f084db7b3a9fea6bb6d49b1df2a3d2a47f73de8c6ce17311df
Instruction ID: e56422bc3a6478092caead34528630b3fe9d65187bff86e833f82c2471e98007
Opcode Fuzzy Hash: 7d9049be05b4b7f084db7b3a9fea6bb6d49b1df2a3d2a47f73de8c6ce17311df
Instruction Fuzzy Hash: 67414373D28681DBD370CF22E4847AAB6A0F7A9388F11132AF749069A4DF7DC554AB40

Function 00007FFE013EDEDC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE013ED6ED,?,?,?,?,?,?,?,?,?,00007FFE013EF23F), ref: 00007FFE013EDF56

Strings

IsValidLocaleName, xrefs: 00007FFE013EDF38
LocaleNameToLCID, xrefs: 00007FFE013EDF4C

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressProc
String ID: IsValidLocaleName$LocaleNameToLCID
API String ID: 190572456-1205873579
Opcode ID: a6681d99a1396304a631d46f2bd7821f4b424c3a5ebbb3bab3d73182fedd9770
Instruction ID: 45803cfcb97282d3d2c512a3b83555957bf1a0e5dd195b8f88c33a0e61131bbd
Opcode Fuzzy Hash: a6681d99a1396304a631d46f2bd7821f4b424c3a5ebbb3bab3d73182fedd9770
Instruction Fuzzy Hash: 5E31BF61B0DB4246FB08DB99E45027562D0AF187D4F4A5135EE1D5B7F8EF2CF80A8240

Function 00007FFE0139A200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,00002000,00007FFE013993D1,?,?,00000000,00007FFE01399319,?,?,?,00007FFE01399088), ref: 00007FFE0139A283
InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00002000,00007FFE013993D1,?,?,00000000,00007FFE01399319,?,?,?,00007FFE01399088), ref: 00007FFE013D4E25

Strings

InitializeCriticalSectionEx, xrefs: 00007FFE0139A279

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressCountCriticalInitializeProcSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 1498394645-3084827643
Opcode ID: 909cbea8ef6e0169b8147f9c897fcf70ffcd4c43e8c559146e0a9d6b551cb605
Instruction ID: 5306919ce4cce0f3034be30ce99c0ebd34f971b201e1232a30b86a6380d5457c
Opcode Fuzzy Hash: 909cbea8ef6e0169b8147f9c897fcf70ffcd4c43e8c559146e0a9d6b551cb605
Instruction Fuzzy Hash: F821B261B1DA5282FB549755F8205752391AF45BD8F056235EC6D4FBF8EE2CF8058340

Function 00007FFE01381818 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0 ref: 00007FFE01381877
IsValidLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FFE013CD034

Strings

IsValidLocaleName, xrefs: 00007FFE0138186D, 00007FFE013CCFEA

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressLocaleProcValid
String ID: IsValidLocaleName
API String ID: 2003423906-4210551052
Opcode ID: 9ff177aa93375c2c15432ad7ee566988a04c92294dfadf1e68a378e6e57af62a
Instruction ID: 0a3e92c44b1582ddbbdc59b542e58e7b0268e5a7e29d6f9f20a9106fc45156ff
Opcode Fuzzy Hash: 9ff177aa93375c2c15432ad7ee566988a04c92294dfadf1e68a378e6e57af62a
Instruction Fuzzy Hash: FB215E21A1D61342FB488795E8611B522A1AF59BD8F06A235ED2D4F7F8EE2CF9458340

Function 00007FFE1A45A524 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A622

Strings

void , xrefs: 00007FFE1A45A5AC
void, xrefs: 00007FFE1A45A584

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: d81aed41cb4c8c5c69bd061dfd49733f36ea67ee8bb27e73bf8cb873ba0293ca
Instruction ID: 6a3847a797ea34b0243600d97617f3cdeba82360af4f26f101c998dbfe1bd0e4
Opcode Fuzzy Hash: d81aed41cb4c8c5c69bd061dfd49733f36ea67ee8bb27e73bf8cb873ba0293ca
Instruction Fuzzy Hash: 373105A2F18B559DFB01DBA5E8400FC37B0BB48B58F4405B6EA4E53A69DF3C9164C750

Function 00007FFE013A1BC8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE0138FA1D), ref: 00007FFE013A1C2B

Strings

CompareStringEx, xrefs: 00007FFE013A1C21
AppPolicyGetThreadInitializationType, xrefs: 00007FFE013D7548

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: AddressProc
String ID: AppPolicyGetThreadInitializationType$CompareStringEx
API String ID: 190572456-1200376162
Opcode ID: b1771694109b89f51a7c1ff2eb7052fff5a9407e5ec637e161e4cc14a56340ac
Instruction ID: bf56bfb204e4a180af81aa9d76a5a7dd0a5b0520eb8e3e1ad78bd9cec4b34345
Opcode Fuzzy Hash: b1771694109b89f51a7c1ff2eb7052fff5a9407e5ec637e161e4cc14a56340ac
Instruction Fuzzy Hash: 8B21CD61F19A0382FF548BA8A860AB453A19F147D8F896135EC2D4F7B4EE2CF9448340

Function 00007FFE11514B20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1151857C: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE115185C0

PyErr_SetString.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE11513F6E), ref: 00007FFE11514BFB

Strings

bad bluetooth address, xrefs: 00007FFE11514BF1
%X:%X:%X:%X:%X:%X%c, xrefs: 00007FFE11514B4B

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Err_String__stdio_common_vsscanf
String ID: %X:%X:%X:%X:%X:%X%c$bad bluetooth address
API String ID: 3283897942-3956635471
Opcode ID: 757c43a982a377d2e6e1a6674c9894cc2490a94952b4447fd658baee6f71c720
Instruction ID: 0c2015c03009c47d769fcb83f35546277d5faa843e6de91901d1ef4c85eb23ae
Opcode Fuzzy Hash: 757c43a982a377d2e6e1a6674c9894cc2490a94952b4447fd658baee6f71c720
Instruction Fuzzy Hash: 9821AC7671CE8196EB11CB02E8881AC73AAF7487E0F518136EAAC47B68DF3DD854C710

Function 00007FFE013B8AA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FFE013B8BB2

Strings

pow, xrefs: 00007FFE013B8BA1
", xrefs: 00007FFE013B8B8B

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: 6a6546b053f3095f7553861cb60331afb3cd7c732f5385389e78b38376567982
Instruction ID: 424cb4ae33d06b8d21800957d2c96b2d3b17eb493d71eb99593266611d955444
Opcode Fuzzy Hash: 6a6546b053f3095f7553861cb60331afb3cd7c732f5385389e78b38376567982
Instruction Fuzzy Hash: 012141B2D1CAC587D370CF24E08466BBAB0FBDA344F211326F7890AA64DBBDD1459B04

Function 00007FFE101D1EB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,00007FFE101D1E02), ref: 00007FFE101D1EF4

Strings

(void*)in != (void*)out, xrefs: 00007FFE101D1EED
src/scrypt.c, xrefs: 00007FFE101D1EE6

Memory Dump Source

Source File: 00000001.00000002.2937326239.00007FFE101D1000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00007FFE101D0000, based on PE: true

Associated: 00000001.00000002.2937311108.00007FFE101D0000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000001.00000002.2937341468.00007FFE101D3000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000001.00000002.2937356318.00007FFE101D4000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000001.00000002.2937371175.00007FFE101D5000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe101d0000_3OQL58yflv.jbxd

Similarity

API ID: _wassert
String ID: (void*)in != (void*)out$src/scrypt.c
API String ID: 3234217646-1092544927
Opcode ID: b1a4e3b3e2a0e0797d6cdbaf5825b108bf68dc55db4e2b5cc03aba4bda832255
Instruction ID: 1920e00c3be6b3e2602746d1f8fa899747039df1952211950012d3a7e3e1975b
Opcode Fuzzy Hash: b1a4e3b3e2a0e0797d6cdbaf5825b108bf68dc55db4e2b5cc03aba4bda832255
Instruction Fuzzy Hash: CF117062B04E9183EA148B47F8442AAA660FB94BD0F494476EF9D47B64DE3CD546C704

Function 00007FFE1A45676F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A456B10: RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A456B60
Part of subcall function 00007FFE1A456B10: RaiseException.KERNEL32 ref: 00007FFE1A456BA1

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A4567DF

Strings

Bad dynamic_cast!, xrefs: 00007FFE1A456792
Access violation - no RTTI data!, xrefs: 00007FFE1A45676F

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 3685223789-3176238549
Opcode ID: 161e8b28e34caca24568961a6528755d3751e4ffa6d3c1bec0c9a5cac7a2823b
Instruction ID: 17a2e61351ae8dc12e7991a8cfa1d336490933007049f6bf365d772dc3632de2
Opcode Fuzzy Hash: 161e8b28e34caca24568961a6528755d3751e4ffa6d3c1bec0c9a5cac7a2823b
Instruction Fuzzy Hash: 690175A1B19D46A1EE40EB16F450178A360FF80F64F4854F3E51E07679EF6CE568C700

Function 00007FFE1A456B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A456B60
RaiseException.KERNEL32 ref: 00007FFE1A456BA1

Strings

csm, xrefs: 00007FFE1A456B8E

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 96783e5d5ee86e7ed91570add2de904558e3ade983638e121ecc73efc59d9239
Instruction ID: cbebe9d87d3f32192772af2eaa90a002eec98cf13a5b03ff9fcc6ff7f3e1d358
Opcode Fuzzy Hash: 96783e5d5ee86e7ed91570add2de904558e3ade983638e121ecc73efc59d9239
Instruction Fuzzy Hash: 86112E72618F8182EB618B16F840269B7E5FB88F99F5842B1DF8C07768DF3DD5618700

Function 00007FFE11515358 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE11513D80: PyErr_Format.PYTHON312 ref: 00007FFE11514102

PySys_Audit.PYTHON312 ref: 00007FFE115153B0

Part of subcall function 00007FFE1151442C: PyEval_SaveThread.PYTHON312 ref: 00007FFE1151444A
Part of subcall function 00007FFE1151442C: connect.WS2_32 ref: 00007FFE1151445D
Part of subcall function 00007FFE1151442C: PyEval_RestoreThread.PYTHON312 ref: 00007FFE11514468
Part of subcall function 00007FFE1151442C: WSAGetLastError.WS2_32 ref: 00007FFE11514476
Part of subcall function 00007FFE1151442C: WSAGetLastError.WS2_32 ref: 00007FFE11514482
Part of subcall function 00007FFE1151442C: PyErr_CheckSignals.PYTHON312 ref: 00007FFE1151448F
Part of subcall function 00007FFE1151442C: WSASetLastError.WS2_32 ref: 00007FFE115144CC

Strings

connect, xrefs: 00007FFE11515377
socket.connect, xrefs: 00007FFE115153A9

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast$Err_Eval_Thread$AuditCheckFormatRestoreSaveSignalsSys_connect
String ID: connect$socket.connect
API String ID: 2206401578-326844852
Opcode ID: 6328d35a7a5ebb17eb66f0d37f02297ffde66ec9a7956e232188b9311fc926bd
Instruction ID: a7cf99122bd5fd964ee23ad2691a32bf0f1a0ad4405d8a8a0f3c73540e92d0ac
Opcode Fuzzy Hash: 6328d35a7a5ebb17eb66f0d37f02297ffde66ec9a7956e232188b9311fc926bd
Instruction Fuzzy Hash: 33115E2171CE8281E7229B23F4407AA636AFF457E8F440072DA4D47A75EE7CE544C700

Function 00007FFE013B9070 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FFE013B9146

Part of subcall function 00007FFE013B34A0: _raise_exc.LIBCMT ref: 00007FFE013B3547

Strings

cos, xrefs: 00007FFE013B9076
!, xrefs: 00007FFE013B912E

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: _handle_error_raise_exc
String ID: !$cos
API String ID: 1935476177-1949035351
Opcode ID: 1484d0b5ffbe851904d8205c7df7cf5da97ca319d906c301c6c44701fd354b64
Instruction ID: a32676abe48bab36c30558e7705b883ab1649fb03326767d9a7062d563cf140f
Opcode Fuzzy Hash: 1484d0b5ffbe851904d8205c7df7cf5da97ca319d906c301c6c44701fd354b64
Instruction Fuzzy Hash: CF019272A18B8582DB14CF22A8403766162FF9A7D8F104334EB5D1BB99EF7CE1509B00

Function 00007FFE013B9090 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_handle_errorf.LIBCMT ref: 00007FFE013B91DF

Part of subcall function 00007FFE013B35D0: _raise_excf.LIBCMT ref: 00007FFE013B3676

Strings

cosf, xrefs: 00007FFE013B9096
!, xrefs: 00007FFE013B91CF

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: _handle_errorf_raise_excf
String ID: !$cosf
API String ID: 3848079588-2208875612
Opcode ID: 6d660574a6daef804eef7dfa845e6527840e46695afe343621e211181e8e6ee1
Instruction ID: 84ce27a7f83ee2da4485220f73bc7a37168af37fdde2d984565e9cbe5d3e3d3b
Opcode Fuzzy Hash: 6d660574a6daef804eef7dfa845e6527840e46695afe343621e211181e8e6ee1
Instruction Fuzzy Hash: 2301B9B291CA4187F314CB26A48437AB991FBD4388F314229F7450AA78EB7CD5816F00

Function 00007FFE013B90B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FFE013B9146

Part of subcall function 00007FFE013B34A0: _raise_exc.LIBCMT ref: 00007FFE013B3547

Strings

sin, xrefs: 00007FFE013B90B6
!, xrefs: 00007FFE013B912E

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: _handle_error_raise_exc
String ID: !$sin
API String ID: 1935476177-1565623160
Opcode ID: 15776cdf7e7771a0a0892c17dc8b27b35bcd0c59846728f0e4c1eb6cb7fe8e0b
Instruction ID: d3a81c1188ec25f0b81e4e78a38d5d2c945dfc1fa6549e882245cc1187f8e39e
Opcode Fuzzy Hash: 15776cdf7e7771a0a0892c17dc8b27b35bcd0c59846728f0e4c1eb6cb7fe8e0b
Instruction Fuzzy Hash: 88018472E18B8582DB15CF22D84037A6262BFDA7D8F504325EB5D1ABA9EF7CD1405B00

Function 00007FFE013B4CE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_errorf.LIBCMT ref: 00007FFE013B4D75

Strings

expf, xrefs: 00007FFE013B4D58
", xrefs: 00007FFE013B4D3F

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: _handle_errorf
String ID: "$expf
API String ID: 2315412904-303238936
Opcode ID: 822081cbaf68a110ada4c82865af82fbb3eb85db9afd55585c3f874f912543b6
Instruction ID: b73caf599a811fd9f8a5e99f06f41660466b807d042d384dd309de64ce880437
Opcode Fuzzy Hash: 822081cbaf68a110ada4c82865af82fbb3eb85db9afd55585c3f874f912543b6
Instruction Fuzzy Hash: 63018272928AC486E330CB21D4893AAB6A0FFE5344F605319E784166B1DF7DD495AB00

Function 00007FFE013B9200 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_handle_errorf.LIBCMT ref: 00007FFE013B91DF

Part of subcall function 00007FFE013B35D0: _raise_excf.LIBCMT ref: 00007FFE013B3676

Strings

sinf, xrefs: 00007FFE013B9206
!, xrefs: 00007FFE013B91CF

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: _handle_errorf_raise_excf
String ID: !$sinf
API String ID: 3848079588-676365165
Opcode ID: 87baaba2b3233784b5bab0be6761438bc72616c16a81b8b5cc63b73ea8544fda
Instruction ID: 2ba2df9548322906a389cc08c80ebf7ea96cfcf30953f180818de80a84ba99c7
Opcode Fuzzy Hash: 87baaba2b3233784b5bab0be6761438bc72616c16a81b8b5cc63b73ea8544fda
Instruction Fuzzy Hash: DD018D7291C68587F314CB26E88436AB991FBD5788F304325E7454BA78DF7CD5805F00

Function 00007FFE013B4C40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FFE013B4CC6

Strings

", xrefs: 00007FFE013B4C9F
exp, xrefs: 00007FFE013B4CB5

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: _handle_error
String ID: "$exp
API String ID: 1757819995-2878093337
Opcode ID: 9942037f99cfb6897b16c6bdf4135bb36f46dc2229e9285eb54b39d86f1d670c
Instruction ID: d8015a53d037e332174b76de1afa4ff4dfd65c7bc0f8db9f80823b2a5e8839f1
Opcode Fuzzy Hash: 9942037f99cfb6897b16c6bdf4135bb36f46dc2229e9285eb54b39d86f1d670c
Instruction Fuzzy Hash: 8701C436938B8883E720CF24D0892AA77A0FFEA704F201315E7451A670DB7DD4C59B00

Function 00007FFE11514198 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFE115141DB

Strings

getsockaddrlen: unknown BT protocol, xrefs: 00007FFE115141CA
getsockaddrlen: bad family, xrefs: 00007FFE115141B3

Memory Dump Source

Source File: 00000001.00000002.2937962236.00007FFE11511000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFE11510000, based on PE: true

Associated: 00000001.00000002.2937944561.00007FFE11510000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2937979185.00007FFE11519000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938006495.00007FFE11521000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000001.00000002.2938023263.00007FFE11523000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11510000_3OQL58yflv.jbxd

Similarity

API ID: Err_String
String ID: getsockaddrlen: bad family$getsockaddrlen: unknown BT protocol
API String ID: 1450464846-3381576205
Opcode ID: 61f6dba2baf4e8a6a13b83a508e2d01ce448c277784260ee3ff2a69e2c2da47f
Instruction ID: 489cbd9a4cdb2f6feabe1a25229bd656ad8558c77204f4e238c115449dffb27f
Opcode Fuzzy Hash: 61f6dba2baf4e8a6a13b83a508e2d01ce448c277784260ee3ff2a69e2c2da47f
Instruction Fuzzy Hash: 110131B5E48D02C5F7274F0AD88427C2AABAB65720F6064B1C50E861F0DF7DA8D69741

Function 00007FFE013B9000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FFE013B9055

Part of subcall function 00007FFE013B34A0: _raise_exc.LIBCMT ref: 00007FFE013B3547

Strings

remainder, xrefs: 00007FFE013B9026
!, xrefs: 00007FFE013B9045

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: _handle_error_raise_exc
String ID: !$remainder
API String ID: 1935476177-2737868549
Opcode ID: bae04a15d8fe45e52485102ce287ed46cf761f668d0f94f2c5930b1148296e41
Instruction ID: 1f1f397edecf3cabf05d90838c34b28dcb173459d45fb49836c59ffc4d309a24
Opcode Fuzzy Hash: bae04a15d8fe45e52485102ce287ed46cf761f668d0f94f2c5930b1148296e41
Instruction Fuzzy Hash: 49F06D72C28A8483E320DF24E4826AAB7B0FFEA358F515315FB8816575DB7DD1868F00

Function 00007FFE1A45F420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A456E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4529EE), ref: 00007FFE1A456E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A45F45A

Strings

f, xrefs: 00007FFE1A45F435
csm, xrefs: 00007FFE1A45F43B

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: abortterminate
String ID: csm$f
API String ID: 661698970-629598281
Opcode ID: f31257b661c57643b6b4b1793288747ab2a9155158c122d579431834bbccefac
Instruction ID: 466f39f7d2c6ad8747c7229578763f3ef958adfb448de98c0d7c4ff533c0d341
Opcode Fuzzy Hash: f31257b661c57643b6b4b1793288747ab2a9155158c122d579431834bbccefac
Instruction Fuzzy Hash: 70E06C71E08B5141DB507B23B14017D6664AF56F75F1480F6DB4807666CF3CD4B08702

Function 00007FFE013C97B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FFE013C97E1
TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE013C8FED,?,?,?,?,00007FFE013C8E11,?,?,?,?,00007FFE01397024), ref: 00007FFE013C97F8

Strings

FlsSetValue, xrefs: 00007FFE013C97CE

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 857b4bba2ea376bd7702fd70110b0ef6706ad2a1eb32f75c1de48caa37b9331b
Instruction ID: 33df95a462b49f3042f9adf3a46bfaddcadbc30183be06da009d8c9d8856dbb4
Opcode Fuzzy Hash: 857b4bba2ea376bd7702fd70110b0ef6706ad2a1eb32f75c1de48caa37b9331b
Instruction Fuzzy Hash: 92E09262A0DA4392FB545F54F8805F83262EF48794F5E4032D92E1E3B4CE7CE885C310

Function 00007FFE0138C3C4 Relevance: 5.3, APIs: 4, Instructions: 265COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,00000000,00000000,?,?,00000000,00007FFE0138C2E1), ref: 00007FFE0138C506
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,00000000,00000000,?,?,00000000,00007FFE0138C2E1), ref: 00007FFE0138C559
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,?,?,00000000,00007FFE0138C2E1), ref: 00007FFE013D0A37

Memory Dump Source

Source File: 00000001.00000002.2936598900.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true

Associated: 00000001.00000002.2936583511.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936654293.00007FFE01435000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936681696.00007FFE0146F000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2936696034.00007FFE01472000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe01380000_3OQL58yflv.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 051a976b41ae5000dd40afa6a0ea54f0385873d016dffbb0923626a41e3e7557
Instruction ID: 0ca9ae774e523c8e04c783158ae3640dbf40816877754bdab97e56832c288a03
Opcode Fuzzy Hash: 051a976b41ae5000dd40afa6a0ea54f0385873d016dffbb0923626a41e3e7557
Instruction Fuzzy Hash: ABB10B61E0C75285FB795B69A4905BD66D0FF44B54F265336EA9E0FAF0CE3CA4C04322

Function 00007FFE11EA9B10 Relevance: 5.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFE11EA9B6E
memmove.VCRUNTIME140 ref: 00007FFE11EB4FEA
memcpy.VCRUNTIME140 ref: 00007FFE11EB5001

Memory Dump Source

Source File: 00000001.00000002.2938193676.00007FFE11EA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE11EA0000, based on PE: true

Associated: 00000001.00000002.2938178726.00007FFE11EA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EB8000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938214377.00007FFE11EBC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938247018.00007FFE11EC4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2938262044.00007FFE11EC5000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe11ea0000_3OQL58yflv.jbxd

Similarity

API ID: memcpy$memmove
String ID:
API String ID: 1283327689-0
Opcode ID: d17e2eabd8e92c8e12be4c81d0eba13f50a3079c5b22873163c7b313a979dc67
Instruction ID: a7ddb0cf319dfa0266e3989f44205fb80c9a3c85c1d31e76f4cba57ba4f5ed2c
Opcode Fuzzy Hash: d17e2eabd8e92c8e12be4c81d0eba13f50a3079c5b22873163c7b313a979dc67
Instruction Fuzzy Hash: 92210332B18A4583D7109F67A80406EB7A5FB14BE0B680139DF8F47BA5DE3DD441C708

Function 00007FFE1A456E64 Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFE1A456CE9,?,?,?,?,00007FFE1A460582,?,?,?,?,?), ref: 00007FFE1A456E83
SetLastError.KERNEL32(?,?,?,00007FFE1A456CE9,?,?,?,?,00007FFE1A460582,?,?,?,?,?), ref: 00007FFE1A456F0C

Memory Dump Source

Source File: 00000001.00000002.2938850050.00007FFE1A451000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2938833625.00007FFE1A450000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938872035.00007FFE1A463000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938888895.00007FFE1A468000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2938904937.00007FFE1A469000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_3OQL58yflv.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 29fbcb28d85caf8942357daff49778de6b87ab13b42ab574bfe6367f35ca65f9
Instruction ID: 33c700dcbbda43727ad60f5bfec39fe087911570393653a7a61029dbca3fc842
Opcode Fuzzy Hash: 29fbcb28d85caf8942357daff49778de6b87ab13b42ab574bfe6367f35ca65f9
Instruction Fuzzy Hash: 181136A1F0DE4282FA55AB67A84417462A1AF44FB4F084AF6E93E077F5DF2CB4618710

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3OQL58yflv.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Metasploit

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_ARC4.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_Salsa20.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_chacha20.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_pkcs1_decode.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_aes.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_aesni.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_arc2.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_blowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cast.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cbc.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cfb.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ctr.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_des.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_des3.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ecb.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_eksblowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ocb.pyd

C:\Users\user\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ofb.pyd

Windows Analysis Report
3OQL58yflv.exe