Edit tour

Windows Analysis Report
UpdaterTool.exe

Overview

General Information

Sample name:	UpdaterTool.exe
Analysis ID:	1584834
MD5:	09cb59f6bbd3558b6698d029c1daccec
SHA1:	37a081e1a56b7b3d7982b299fe91fa8635163369
SHA256:	b88638ea23c4629fc7a28953b14ffabcf9b8fa302b552930512629c2c8a5be1a
Tags:	exeuser-aachum
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

AI detected suspicious URL

AI detected suspicious sample

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

UpdaterTool.exe (PID: 7432 cmdline: "C:\Users\user\Desktop\UpdaterTool.exe" MD5: 09CB59F6BBD3558B6698D029C1DACCEC)

UpdaterTool.exe (PID: 7456 cmdline: "C:\Users\user\Desktop\UpdaterTool.exe" MD5: 09CB59F6BBD3558B6698D029C1DACCEC)

cmd.exe (PID: 7508 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7556 cmdline: schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST MD5: 76CD6626DD8834BD4A42E6A565104DC2)

chrome.exe (PID: 3624 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://alert-metamask.info/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7120 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1788,i,3885513550755460943,12905883307123306454,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

UpdaterTool.exe (PID: 7604 cmdline: C:\Users\user\Desktop\UpdaterTool.exe MD5: 09CB59F6BBD3558B6698D029C1DACCEC)

UpdaterTool.exe (PID: 7624 cmdline: C:\Users\user\Desktop\UpdaterTool.exe MD5: 09CB59F6BBD3558B6698D029C1DACCEC)

cmd.exe (PID: 7664 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7716 cmdline: schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cleanup

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST", CommandLine: C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\UpdaterTool.exe", ParentImage: C:\Users\user\Desktop\UpdaterTool.exe, ParentProcessId: 7456, ParentProcessName: UpdaterTool.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST", ProcessId: 7508, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://alert-metamask.info/	Avira URL Cloud: Label: malware
Source: http://alert-metamask.info/583	Avira URL Cloud: Label: malware
Source: http://alert-metamask.info//-	Avira URL Cloud: Label: malware
Source: http://alert-metamask.info//c=I	Avira URL Cloud: Label: malware
Source: http://alert-metamask.info/w/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: UpdaterTool.exe

ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACAFAF0 CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	1_2_00007FFDFACAFAF0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACCFB00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	1_2_00007FFDFACCFB00
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC97A60 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,strncmp,CRYPTO_free,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_delete,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	1_2_00007FFDFAC97A60
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACE3A60 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	1_2_00007FFDFACE3A60
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACC9A60 ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_set_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFDFACC9A60
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81483 CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFAC81483
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC819E7 CRYPTO_free,	1_2_00007FFDFAC819E7
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8155A ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	1_2_00007FFDFAC8155A
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81582 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	1_2_00007FFDFAC81582
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC95BB0 OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	1_2_00007FFDFAC95BB0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACADBA0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	1_2_00007FFDFACADBA0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACE1B9F CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFDFACE1B9F
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACFBB70 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,OPENSSL_sk_push,OPENSSL_sk_num,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_value,X509_get0_pubkey,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,	1_2_00007FFDFACFBB70
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACA5B90 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFDFACA5B90
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81E6A ERR_new,ERR_set_debug,CRYPTO_clear_free,	1_2_00007FFDFAC81E6A
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81654 EVP_MD_CTX_new,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_PKEY_get_id,ERR_new,EVP_MD_get0_name,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,BUF_reverse,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_MD_CTX_ctrl,ERR_new,ERR_set_debug,ERR_new,EVP_DigestVerify,ERR_new,ERR_new,ERR_new,ERR_set_debug,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	1_2_00007FFDFAC81654
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8F910 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,CRYPTO_malloc,EVP_PKEY_encapsulate,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_free,EVP_PKEY_CTX_free,	1_2_00007FFDFAC8F910
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACFB900 BN_bin2bn,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFACFB900
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC813DE EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_security_bits,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,EVP_PKEY_get_bn_param,EVP_PKEY_get_bn_param,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,ERR_set_debug,EVP_DigestSign,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_free,BN_free,BN_free,BN_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFAC813DE
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACB38C0 CRYPTO_malloc,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,memset,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,ERR_set_debug,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_set_mark,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFACB38C0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC99870 CRYPTO_free,CRYPTO_strdup,	1_2_00007FFDFAC99870
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8589C BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	1_2_00007FFDFAC8589C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACEBA20 CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFACEBA20
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81A41 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFAC81A41
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81A15 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	1_2_00007FFDFAC81A15
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACC3A00 CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFACC3A00
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC811DB EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	1_2_00007FFDFAC811DB
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACD1970 ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,	1_2_00007FFDFACD1970
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8105F ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_clear_free,	1_2_00007FFDFAC8105F
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACCD980 RAND_bytes_ex,CRYPTO_malloc,memset,	1_2_00007FFDFACCD980
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC9BF30 CRYPTO_memcmp,	1_2_00007FFDFAC9BF30
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACE3F30 ERR_new,ERR_set_debug,X509_get0_pubkey,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,CRYPTO_malloc,EVP_PKEY_encrypt_init,RAND_bytes_ex,EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	1_2_00007FFDFACE3F30
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81C53 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	1_2_00007FFDFAC81C53
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC95F20 CRYPTO_THREAD_run_once,	1_2_00007FFDFAC95F20
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACEDF40 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,	1_2_00007FFDFACEDF40
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC85EE0 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	1_2_00007FFDFAC85EE0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC82680 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	1_2_00007FFDFAC82680
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC83EB0 CRYPTO_free,	1_2_00007FFDFAC83EB0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8107D CRYPTO_free,	1_2_00007FFDFAC8107D
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC82720 CRYPTO_free,CRYPTO_strdup,	1_2_00007FFDFAC82720
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8150F OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	1_2_00007FFDFAC8150F
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC825DB CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	1_2_00007FFDFAC825DB
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACA6030 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,d2i_X509,X509_get0_pubkey,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFDFACA6030
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8202C CRYPTO_free,	1_2_00007FFDFAC8202C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC823EC CRYPTO_free,CRYPTO_memdup,	1_2_00007FFDFAC823EC
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81019 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFAC81019
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8DFB5 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFAC8DFB5
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81B18 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_memcmp,ERR_new,ERR_new,	1_2_00007FFDFAC81B18
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACA5D20 CRYPTO_free,CRYPTO_free,	1_2_00007FFDFACA5D20
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81CEE CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	1_2_00007FFDFAC81CEE
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACE3D20 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	1_2_00007FFDFACE3D20
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC82595 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	1_2_00007FFDFAC82595
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC95CB0 COMP_zlib,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	1_2_00007FFDFAC95CB0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC823F1 CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFAC823F1
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC93CC0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	1_2_00007FFDFAC93CC0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC85C9B CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	1_2_00007FFDFAC85C9B
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACEBE20 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFACEBE20
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACA5E10 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFDFACA5E10
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8108C ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFDFAC8108C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC82310 ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_new,EVP_MD_fetch,ERR_new,ERR_new,ERR_set_debug,EVP_MD_free,EVP_MD_get_size,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_free,CRYPTO_free,	1_2_00007FFDFAC82310
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81D89 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFDFAC81D89
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACB92E0 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFDFACB92E0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81677 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	1_2_00007FFDFAC81677
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8111D CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	1_2_00007FFDFAC8111D
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8B300 CRYPTO_clear_free,	1_2_00007FFDFAC8B300
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC817F8 EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key_ex,EVP_DigestSignInit_ex,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFAC817F8
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8195B CRYPTO_zalloc,EVP_MAC_free,EVP_MAC_CTX_free,CRYPTO_free,	1_2_00007FFDFAC8195B
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81A32 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	1_2_00007FFDFAC81A32
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACF3260 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFDFACF3260
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81F8C CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFDFAC81F8C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACFB430 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_set_rsa_padding,OSSL_PARAM_construct_uint,OSSL_PARAM_construct_end,EVP_PKEY_CTX_set_params,EVP_PKEY_decrypt,OPENSSL_cleanse,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_CTX_free,	1_2_00007FFDFACFB430
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81444 EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,	1_2_00007FFDFAC81444
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81997 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_decapsulate,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	1_2_00007FFDFAC81997
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8D3CA CRYPTO_free,	1_2_00007FFDFAC8D3CA
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC811A9 EVP_MAC_CTX_free,CRYPTO_free,	1_2_00007FFDFAC811A9
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACC9120 CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFDFACC9120
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC821DF CRYPTO_memcmp,	1_2_00007FFDFAC821DF
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACC30A0 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	1_2_00007FFDFACC30A0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC814CE CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFDFAC814CE
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACB50D8 EVP_MAC_CTX_free,CRYPTO_free,	1_2_00007FFDFACB50D8
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC82374 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFAC82374
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACAF070 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,ERR_new,ERR_set_debug,memcpy,	1_2_00007FFDFACAF070
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACFB070 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFACFB070
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACE5070 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFACE5070
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACA9080 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	1_2_00007FFDFACA9080
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACE7230 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFDFACE7230
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8D227 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFDFAC8D227
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81B90 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	1_2_00007FFDFAC81B90
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81262 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	1_2_00007FFDFAC81262
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81A23 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	1_2_00007FFDFAC81A23
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACAD170 CRYPTO_THREAD_write_lock,OPENSSL_sk_new_null,OPENSSL_LH_delete,OPENSSL_sk_push,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,OPENSSL_sk_pop_free,	1_2_00007FFDFACAD170
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACE1170 ERR_new,ERR_set_debug,CRYPTO_clear_free,	1_2_00007FFDFACE1170
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8F160 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFDFAC8F160
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81023 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFAC81023
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACD1750 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFDFACD1750
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC812CB CRYPTO_THREAD_run_once,	1_2_00007FFDFAC812CB
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACC56D0 CRYPTO_free,	1_2_00007FFDFACC56D0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACEB660 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	1_2_00007FFDFACEB660
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC97840 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	1_2_00007FFDFAC97840
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81087 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	1_2_00007FFDFAC81087
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACF57FE CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFACF57FE
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACE17A1 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFDFACE17A1
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACD77A0 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFACD77A0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC811BD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFAC811BD
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8193D CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFDFAC8193D
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81992 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,OPENSSL_LH_new,X509_STORE_new,CTLOG_STORE_new_ex,OPENSSL_sk_num,X509_VERIFY_PARAM_new,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,CRYPTO_secure_zalloc,RAND_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,ERR_new,ERR_set_debug,	1_2_00007FFDFAC81992
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACD14E0 CRYPTO_memcmp,	1_2_00007FFDFACD14E0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACAD510 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	1_2_00007FFDFACAD510
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81EDD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFDFAC81EDD
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC82126 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFAC82126
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81393 OSSL_PROVIDER_do_all,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	1_2_00007FFDFAC81393
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACF3480 CRYPTO_free,CRYPTO_strndup,	1_2_00007FFDFACF3480
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC91620 CRYPTO_free,CRYPTO_strndup,	1_2_00007FFDFAC91620
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8F650 EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_derive_set_peer,EVP_PKEY_is_a,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_derive,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,	1_2_00007FFDFAC8F650
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACF3650 CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_fetch,EVP_CIPHER_get_iv_length,RAND_bytes_ex,EVP_CIPHER_free,EVP_EncryptUpdate,EVP_EncryptFinal,ERR_new,ERR_new,CRYPTO_free,EVP_CIPHER_CTX_free,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get_iv_length,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_CIPHER_CTX_free,	1_2_00007FFDFACF3650
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC82379 CRYPTO_free,	1_2_00007FFDFAC82379
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81181 CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFAC81181
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8110E EVP_PKEY_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,	1_2_00007FFDFAC8110E
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC82469 CRYPTO_memcmp,ERR_new,ERR_set_debug,memchr,ERR_new,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFAC82469
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC821E9 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	1_2_00007FFDFAC821E9
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACD7570 CRYPTO_realloc,	1_2_00007FFDFACD7570
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC820F4 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFAC820F4
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC84B30 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFDFAC84B30
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81460 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_snprintf,	1_2_00007FFDFAC81460
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC96B20 CRYPTO_THREAD_run_once,OPENSSL_sk_find,OPENSSL_sk_value,EVP_CIPHER_fetch,EVP_CIPHER_get_flags,	1_2_00007FFDFAC96B20
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC9EB48 CRYPTO_free,	1_2_00007FFDFAC9EB48
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACAEB10 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	1_2_00007FFDFACAEB10
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8114F CRYPTO_free,ERR_new,ERR_set_debug,	1_2_00007FFDFAC8114F
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACE4C40 ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	1_2_00007FFDFACE4C40
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81AB4 CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFDFAC81AB4
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACCEC10 CRYPTO_free,	1_2_00007FFDFACCEC10
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC84C00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFDFAC84C00
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81A0F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_CIPHER_get_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,CRYPTO_memcmp,ERR_set_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_pop_to_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,strncmp,strncmp,strncmp,strncmp,strncmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFDFAC81A0F
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC94930 CRYPTO_get_ex_new_index,	1_2_00007FFDFAC94930
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACCE920 CRYPTO_free,	1_2_00007FFDFACCE920
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81EE2 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,EVP_MD_get0_name,EVP_MD_is_a,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFDFAC81EE2
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACFA8F0 EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_clear_error,ASN1_item_d2i,ASN1_TYPE_get,ERR_new,ERR_set_debug,EVP_PKEY_decrypt,ERR_new,EVP_PKEY_CTX_ctrl,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,ASN1_item_free,	1_2_00007FFDFACFA8F0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACEC8E0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFACEC8E0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8139D memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	1_2_00007FFDFAC8139D
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC826B2 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	1_2_00007FFDFAC826B2
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACCE8C0 CRYPTO_free,	1_2_00007FFDFACCE8C0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACF8870 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFACF8870
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACE4860 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	1_2_00007FFDFACE4860
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81492 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFAC81492
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACC2A50 SRP_Calc_u_ex,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,BN_clear_free,BN_clear_free,	1_2_00007FFDFACC2A50
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81A05 ERR_new,ERR_set_debug,ERR_set_error,ASN1_item_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ASN1_item_free,	1_2_00007FFDFAC81A05
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACD89F0 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFDFACD89F0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC824EB CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFDFAC824EB
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81893 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_strdup,ERR_new,ERR_set_debug,	1_2_00007FFDFAC81893
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8204F CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFDFAC8204F
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC817DF ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFDFAC817DF
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC82185 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,	1_2_00007FFDFAC82185
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC94990 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFAC94990
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACF2EE0 CRYPTO_memcmp,	1_2_00007FFDFACF2EE0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8CEA0 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	1_2_00007FFDFAC8CEA0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC817E9 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,CRYPTO_memdup,ERR_new,ERR_new,ERR_new,ERR_set_debug,	1_2_00007FFDFAC817E9
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8236A CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFAC8236A
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8117C _time64,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	1_2_00007FFDFAC8117C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACC8E90 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFDFACC8E90
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC82117 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	1_2_00007FFDFAC82117
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC820E5 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFAC820E5
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC84FD0 CRYPTO_free,	1_2_00007FFDFAC84FD0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC82144 EVP_CIPHER_get_mode,EVP_CIPHER_get_mode,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFDFAC82144
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8136B ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFAC8136B
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC9CD30 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,EVP_MD_get0_provider,EVP_MD_free,EVP_MD_get0_provider,EVP_MD_free,EVP_CIPHER_get0_provider,EVP_CIPHER_free,EVP_MD_get0_provider,EVP_MD_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFAC9CD30
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81CBC EVP_MD_get_size,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFAC81CBC
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACC8D40 OPENSSL_cleanse,CRYPTO_free,	1_2_00007FFDFACC8D40
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8257C ERR_new,ERR_set_debug,CRYPTO_free,BIO_clear_flags,BIO_set_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_cleanse,	1_2_00007FFDFAC8257C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACD8CA0 CRYPTO_free,CRYPTO_strndup,	1_2_00007FFDFACD8CA0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACCEC70 CRYPTO_free,	1_2_00007FFDFACCEC70
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC822D9 CRYPTO_malloc,CONF_parse_list,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFAC822D9
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACC8C80 CRYPTO_free,	1_2_00007FFDFACC8C80
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81811 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	1_2_00007FFDFAC81811
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC9EDC1 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	1_2_00007FFDFAC9EDC1
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81B54 memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,memcmp,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFDFAC81B54
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81771 CRYPTO_free,	1_2_00007FFDFAC81771
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC9EDC1 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	1_2_00007FFDFAC9EDC1
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8222F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,	1_2_00007FFDFAC8222F
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACE0330 CRYPTO_free,CRYPTO_strndup,	1_2_00007FFDFACE0330
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81B31 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFAC81B31
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC84300 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFDFAC84300
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC9E427 CRYPTO_THREAD_write_lock,	1_2_00007FFDFAC9E427
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8198D CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	1_2_00007FFDFAC8198D
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACA2410 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	1_2_00007FFDFACA2410
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC823DD EVP_MD_get_size,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_clear_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	1_2_00007FFDFAC823DD
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81D93 EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,CRYPTO_zalloc,EVP_MAC_CTX_free,EVP_MAC_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_fetch,EVP_MAC_CTX_new,EVP_MAC_free,EVP_CIPHER_CTX_new,EVP_CIPHER_fetch,OSSL_PARAM_construct_utf8_string,OSSL_PARAM_construct_end,EVP_MAC_init,EVP_DecryptInit_ex,EVP_CIPHER_free,EVP_CIPHER_free,EVP_CIPHER_free,EVP_MAC_CTX_get_mac_size,EVP_CIPHER_CTX_get_iv_length,EVP_MAC_final,CRYPTO_memcmp,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_CTX_free,CRYPTO_free,	1_2_00007FFDFAC81D93
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACEA3D0 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFACEA3D0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACE43C0 EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,	1_2_00007FFDFACE43C0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC92360 CRYPTO_THREAD_run_once,	1_2_00007FFDFAC92360
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACD8390 CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFACD8390
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC819DD BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	1_2_00007FFDFAC819DD
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81361 CRYPTO_malloc,EVP_PKEY_set_type,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_CTX_free,ERR_pop_to_mark,CRYPTO_free,EVP_PKEY_free,	1_2_00007FFDFAC81361
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC84100 CRYPTO_free,	1_2_00007FFDFAC84100
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8E0AD ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,	1_2_00007FFDFAC8E0AD
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACA20A0 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	1_2_00007FFDFACA20A0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACE00A0 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFDFACE00A0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACD80C0 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFDFACD80C0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC82527 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFDFAC82527
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC9C080 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFDFAC9C080
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA01582 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	6_2_00007FFDFBA01582
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA0155A ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	6_2_00007FFDFBA0155A
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA01483 CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	6_2_00007FFDFBA01483
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA019E7 CRYPTO_free,	6_2_00007FFDFBA019E7
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA25B90 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	6_2_00007FFDFBA25B90
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA7BB70 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,OPENSSL_sk_push,OPENSSL_sk_num,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_value,X509_get0_pubkey,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,	6_2_00007FFDFBA7BB70
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA15BB0 OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	6_2_00007FFDFBA15BB0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA2DBA0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	6_2_00007FFDFBA2DBA0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA61B9F CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	6_2_00007FFDFBA61B9F
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA4FB00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	6_2_00007FFDFBA4FB00
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA2FAF0 CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	6_2_00007FFDFBA2FAF0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA17A60 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,strncmp,CRYPTO_free,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_delete,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	6_2_00007FFDFBA17A60
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA63A60 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	6_2_00007FFDFBA63A60
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA49A60 ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_set_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,	6_2_00007FFDFBA49A60
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA43A00 CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	6_2_00007FFDFBA43A00
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA01A15 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	6_2_00007FFDFBA01A15
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA01A41 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	6_2_00007FFDFBA01A41
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA6BA20 CRYPTO_free,CRYPTO_free,CRYPTO_free,	6_2_00007FFDFBA6BA20
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA0105F ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_clear_free,	6_2_00007FFDFBA0105F
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA4D980 RAND_bytes_ex,CRYPTO_malloc,memset,	6_2_00007FFDFBA4D980
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA51970 ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,	6_2_00007FFDFBA51970
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA011DB EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	6_2_00007FFDFBA011DB
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA0F910 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,CRYPTO_malloc,EVP_PKEY_encapsulate,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_free,EVP_PKEY_CTX_free,	6_2_00007FFDFBA0F910
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA7B900 BN_bin2bn,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	6_2_00007FFDFBA7B900
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA01654 EVP_MD_CTX_new,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_PKEY_get_id,ERR_new,EVP_MD_get0_name,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,BUF_reverse,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_MD_CTX_ctrl,ERR_new,ERR_set_debug,ERR_new,EVP_DigestVerify,ERR_new,ERR_new,ERR_new,ERR_set_debug,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	6_2_00007FFDFBA01654
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA01E6A ERR_new,ERR_set_debug,CRYPTO_clear_free,	6_2_00007FFDFBA01E6A
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA0589C BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	6_2_00007FFDFBA0589C

Phishing

AI detected suspicious URL

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://alert-metamask.info
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://alert-metamask.info

Source: UpdaterTool.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2951840830.00007FFE01377000.00000002.00000001.01000000.00000014.sdmp, UpdaterTool.exe, 00000005.00000003.1775596108.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2950278609.00007FFDFB9F7000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: UpdaterTool.exe, 00000001.00000002.2949319095.00007FFDFB19A000.00000002.00000001.01000000.0000000F.sdmp, UpdaterTool.exe, 00000006.00000002.2947899878.00007FFDF9D2A000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\_win32sysloader.pdb source: UpdaterTool.exe, 00000000.00000003.1698853743.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775851430.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptography_rust.pdbc source: UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: UpdaterTool.exe, 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb** source: UpdaterTool.exe, 00000001.00000002.2952622584.00007FFE0E171000.00000002.00000001.01000000.00000018.sdmp, UpdaterTool.exe, 00000006.00000002.2951237378.00007FFDFF6B1000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2953956063.00007FFE11BB4000.00000002.00000001.01000000.00000015.sdmp, UpdaterTool.exe, 00000005.00000003.1764918641.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2952681947.00007FFE08ED4000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: crypto\bn\bn_ctx.cBN_CTX_startBN_CTX_getossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcrypto\evp\digest.cevp_md_ctx_new_exevp_md_ctx_free_algctxevp_md_init_internalEVP_DigestUpdatesizeEVP_DigestFinal_exassertion failed: mdsize <= EVP_MAX_MD_SIZEEVP_DigestFinalXOFxoflenEVP_MD_CTX_copy_exEVP_MD_CTX_ctrlmicalgssl3-msblocksizexofalgid-absentevp_md_from_algorithmupdatecrypto\evp\m_sigver.cUNDEFdo_sigver_initEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestSignEVP_DigestVerifyFinalEVP_DigestVerifycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Fri Oct 18 00:15:00 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb}},GCTL source: UpdaterTool.exe, 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32trace.pdb source: UpdaterTool.exe, 00000000.00000003.1699093300.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1776131249.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\engine\tb_digest.cENGINE_get_digestcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: UpdaterTool.exe, 00000000.00000003.1687683597.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2954670837.00007FFE126F4000.00000002.00000001.01000000.00000005.sdmp, UpdaterTool.exe, 00000005.00000003.1763260702.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2953613558.00007FFE101E4000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: UpdaterTool.exe, 00000001.00000002.2949319095.00007FFDFB102000.00000002.00000001.01000000.0000000F.sdmp, UpdaterTool.exe, 00000006.00000002.2947899878.00007FFDF9C92000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: UpdaterTool.exe, 00000000.00000003.1687683597.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2954670837.00007FFE126F4000.00000002.00000001.01000000.00000005.sdmp, UpdaterTool.exe, 00000005.00000003.1763260702.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2953613558.00007FFE101E4000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb!! source: UpdaterTool.exe, 00000001.00000002.2952420191.00007FFE0E143000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: UpdaterTool.exe, 00000001.00000002.2949319095.00007FFDFB19A000.00000002.00000001.01000000.0000000F.sdmp, UpdaterTool.exe, 00000006.00000002.2947899878.00007FFDF9D2A000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb source: UpdaterTool.exe, 00000001.00000002.2952420191.00007FFE0E143000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: UpdaterTool.exe, 00000000.00000003.1687845661.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2953766612.00007FFE117E5000.00000002.00000001.01000000.00000016.sdmp, UpdaterTool.exe, 00000005.00000003.1763444136.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2952491969.00007FFE02A15000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2955038395.00007FFE13303000.00000002.00000001.01000000.0000000C.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: UpdaterTool.exe, 00000001.00000002.2954317646.00007FFE11ED3000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb source: UpdaterTool.exe, 00000001.00000002.2952622584.00007FFE0E171000.00000002.00000001.01000000.00000018.sdmp, UpdaterTool.exe, 00000006.00000002.2951237378.00007FFDFF6B1000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2954912779.00007FFE130C6000.00000002.00000001.01000000.00000010.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2953806905.00007FFE10236000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2953528643.00007FFE1151B000.00000002.00000001.01000000.0000000A.sdmp, UpdaterTool.exe, 00000005.00000003.1764363951.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2952086765.00007FFE0074B000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2954793185.00007FFE12E13000.00000002.00000001.01000000.00000011.sdmp, UpdaterTool.exe, 00000005.00000003.1764509163.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb source: UpdaterTool.exe, 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2953528643.00007FFE1151B000.00000002.00000001.01000000.0000000A.sdmp, UpdaterTool.exe, 00000005.00000003.1764363951.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2952086765.00007FFE0074B000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2954542077.00007FFE126CD000.00000002.00000001.01000000.00000009.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2953408821.00007FFE0EB2D000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2953956063.00007FFE11BB4000.00000002.00000001.01000000.00000015.sdmp, UpdaterTool.exe, 00000005.00000003.1764918641.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2952681947.00007FFE08ED4000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2954147891.00007FFE11EA9000.00000002.00000001.01000000.0000000B.sdmp, UpdaterTool.exe, 00000005.00000003.1764608058.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2952314784.00007FFE01219000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: cryptography_rust.pdb source: UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2939927246.0000020DC6D70000.00000002.00000001.01000000.00000006.sdmp, UpdaterTool.exe, 00000005.00000003.1772919592.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939152139.00000222A2840000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: UpdaterTool.exe, 00000001.00000002.2950295771.00007FFDFB668000.00000002.00000001.01000000.00000004.sdmp, UpdaterTool.exe, 00000006.00000002.2948861525.00007FFDFA1F8000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: UpdaterTool.exe, 00000000.00000003.1687845661.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2953766612.00007FFE117E5000.00000002.00000001.01000000.00000016.sdmp, UpdaterTool.exe, 00000005.00000003.1763444136.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2952491969.00007FFE02A15000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: UpdaterTool.exe, 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: UpdaterTool.exe, 00000001.00000002.2953053216.00007FFE1024E000.00000002.00000001.01000000.0000000D.sdmp

Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E5789280 FindFirstFileExW,FindClose,	0_2_00007FF6E5789280
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57A1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6E57A1874
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57883C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6E57883C0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E5789280 FindFirstFileExW,FindClose,	1_2_00007FF6E5789280
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57A1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6E57A1874
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57883C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF6E57883C0

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 6_2_00007FFDFF1553D0 PyArg_ParseTuple,GetLogicalDriveStringsW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,GetLogicalDriveStringsW,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W_J@Z,

6_2_00007FFDFF1553D0

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.4:55575 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 185.199.111.153 185.199.111.153
Source: Joe Sandbox View	IP Address: 185.199.111.153 185.199.111.153
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: NTT-LT-ASLT NTT-LT-ASLT

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 2.22.50.144
Source: unknown	TCP traffic detected without corresponding DNS query: 2.22.50.144
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: alert-metamask.infoConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/icon.svg HTTP/1.1Host: metamask.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://alert-metamask.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/icon.svg HTTP/1.1Host: metamask.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: alert-metamask.infoConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: alert-metamask.info
Source: global traffic	DNS traffic detected: DNS query: metamask.io
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: UpdaterTool.exe, 00000001.00000002.2944280136.0000020DC7E90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: UpdaterTool.exe, 00000001.00000002.2941547478.0000020DC7590000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://alert-metamask.info/
Source: UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC83BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://alert-metamask.info//-
Source: UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC83A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://alert-metamask.info//c=I
Source: UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC8375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://alert-metamask.info/583
Source: UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC8375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://alert-metamask.info/Qx
Source: UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC83BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://alert-metamask.info/S-e
Source: UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC83A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://alert-metamask.info/SJ
Source: UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC83BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://alert-metamask.info/w/
Source: UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764762314.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775596108.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688354629.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688215399.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694448218.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695661566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688354629.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688215399.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694448218.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695661566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688354629.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688215399.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694448218.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695661566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1773687057.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688354629.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688215399.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694448218.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695661566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digix
Source: UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7583000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943452738.00000222A55A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: UpdaterTool.exe, 00000001.00000002.2939393895.0000020DC5477000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A50B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlhX
Source: UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7583000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943452738.00000222A55A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlh
Source: UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A50B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crlp
Source: UpdaterTool.exe, 00000006.00000002.2941724108.00000222A50B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A50B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688354629.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688215399.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694448218.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695661566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688354629.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688215399.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694448218.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695661566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688354629.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688215399.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694448218.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695661566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1773687057.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: UpdaterTool.exe, 00000005.00000003.1764608058.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688354629.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688215399.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694448218.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695661566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: UpdaterTool.exe, 00000001.00000003.1712398878.0000020DC7A64000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944280136.0000020DC7E90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711949654.0000020DC7A39000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2942856317.00000222A51F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787217256.00000222A506B000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787327944.00000222A4F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: UpdaterTool.exe, 00000001.00000002.2945655139.0000020DC8890000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/zeJZl.
Source: UpdaterTool.exe, 00000006.00000003.1787859354.00000222A4E1A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788159871.00000222A489D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: UpdaterTool.exe, 00000001.00000003.1710963005.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712670373.0000020DC7522000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714594509.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC789C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710428295.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710255818.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786586199.00000222A4E19000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1790132663.00000222A4E21000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787859354.00000222A4E1A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788159871.00000222A489D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail
Source: UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC782A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC782A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC782A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC789C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786586199.00000222A4E19000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1790132663.00000222A4E21000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787859354.00000222A4E1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://httpbin.org/
Source: UpdaterTool.exe, 00000001.00000002.2944468574.0000020DC7F90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688354629.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688215399.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694448218.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695661566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688354629.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688215399.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694448218.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695661566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688354629.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688215399.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694448218.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695661566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688354629.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688215399.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694448218.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695661566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1773687057.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: UpdaterTool.exe, 00000001.00000002.2940664459.0000020DC705C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: UpdaterTool.exe, 00000006.00000002.2941724108.00000222A505E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/z
Source: UpdaterTool.exe, 00000001.00000002.2941750370.0000020DC7690000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941277308.00000222A4AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7583000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A50B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: UpdaterTool.exe, 00000006.00000002.2941724108.00000222A50B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl~
Source: UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7583000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688354629.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1693125430.000002322272A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1688215399.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1694448218.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1695661566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943452738.00000222A55A1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC73FD000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714881533.0000020DC73F4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1785862423.00000222A4D67000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A505E000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A50B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: UpdaterTool.exe, 00000001.00000003.1712670373.0000020DC7522000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714594509.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712398878.0000020DC7A64000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711949654.0000020DC7A39000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787217256.00000222A506B000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787327944.00000222A4F64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: UpdaterTool.exe, 00000001.00000003.1710963005.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712670373.0000020DC7522000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714594509.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC789C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710428295.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710255818.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786586199.00000222A4E19000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1790132663.00000222A4E21000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787859354.00000222A4E1A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788159871.00000222A489D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yahoo.com/
Source: UpdaterTool.exe, 00000006.00000002.2941277308.00000222A4AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: UpdaterTool.exe, 00000001.00000002.2946195728.0000020DC8C14000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2946195728.0000020DC8BD8000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2945077322.00000222A6014000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8189223637:AAFivU8R-ibjnOIJ-jbNzhmXtzM-HgY1524/sendMessage
Source: UpdaterTool.exe, 00000001.00000002.2946195728.0000020DC8C14000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8189223637:AAFivU8R-ibjnOIJ-jbNzhmXtzM-HgY1524/sendMessage0
Source: UpdaterTool.exe	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC8375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: UpdaterTool.exe, 00000001.00000002.2943807264.0000020DC7C90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2942707407.00000222A50F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cloud.google.com/appengine/docs/standard/runtimes
Source: UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io
Source: UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/
Source: UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC8375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: UpdaterTool.exe, 00000001.00000003.1710963005.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712670373.0000020DC7522000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714594509.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1709162511.0000020DC74CD000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710428295.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1784298765.00000222A497B000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788526301.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786187452.00000222A48F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: UpdaterTool.exe, 00000001.00000002.2940973947.0000020DC7290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6E50000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A42B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6E50000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A42B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6ED4000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A4334000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6E50000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A42B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6ED4000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A4334000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6E50000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A42B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6E50000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A42B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6E50000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A42B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: UpdaterTool.exe, 00000001.00000002.2939393895.0000020DC5477000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939235749.00000222A28F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/socket.html#socket.socket.connect_ex
Source: UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC8375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: UpdaterTool.exe, 00000001.00000003.1714079036.0000020DC795F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC791D000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4E79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: UpdaterTool.exe, 00000001.00000002.2940664459.0000020DC705C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939235749.00000222A28F6000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1779370742.00000222A44E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
Source: UpdaterTool.exe, 00000001.00000002.2945655139.0000020DC8890000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: UpdaterTool.exe, UpdaterTool.exe, 00000006.00000002.2951315641.00007FFDFF6C2000.00000002.00000001.01000000.00000032.sdmp, UpdaterTool.exe, 00000006.00000002.2951114413.00007FFDFF171000.00000002.00000001.01000000.00000034.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32
Source: UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography
Source: UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/
Source: UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6ED4000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A4334000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: UpdaterTool.exe, 00000006.00000003.1779370742.00000222A44E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: UpdaterTool.exe, 00000001.00000002.2940664459.0000020DC705C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939235749.00000222A28F6000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1779370742.00000222A44E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: UpdaterTool.exe, 00000001.00000003.1710393826.0000020DC7916000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710255818.0000020DC786B000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2940664459.0000020DC705C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710206198.0000020DC7916000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1785765333.00000222A4E9F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788159871.00000222A489D000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788795117.00000222A4E9F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787859354.00000222A4E9F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1785862423.00000222A4DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: UpdaterTool.exe, 00000001.00000002.2944468574.0000020DC7F90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
Source: UpdaterTool.exe, 00000001.00000002.2940664459.0000020DC705C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939235749.00000222A28F6000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1779370742.00000222A44E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC782A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC782A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC782A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710255818.0000020DC786B000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710255818.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788526301.00000222A49E3000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787282619.00000222A49E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: UpdaterTool.exe, 00000006.00000002.2942707407.00000222A50F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/497
Source: UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC789C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786586199.00000222A4E19000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1790132663.00000222A4E21000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787859354.00000222A4E1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: UpdaterTool.exe, 00000001.00000003.1710963005.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1707894054.0000020DC74D9000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714594509.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1709162511.0000020DC74CD000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710428295.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708023539.0000020DC74D0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708023539.0000020DC7474000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708607542.0000020DC74D0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1784855892.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788526301.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786187452.00000222A48F1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1784855892.00000222A4900000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1790265075.00000222A5017000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787327944.00000222A501B000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788795117.00000222A4E9F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787859354.00000222A4E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: UpdaterTool.exe, 00000001.00000003.1713551694.0000020DC77A2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714881533.0000020DC73F4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC7799000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4E79000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1789451791.00000222A4F9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: UpdaterTool.exe, 00000001.00000003.1700855729.0000020DC7051000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941547478.0000020DC7590000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1777328782.00000222A44B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: UpdaterTool.exe, 00000001.00000002.2950295771.00007FFDFB668000.00000002.00000001.01000000.00000004.sdmp, UpdaterTool.exe, 00000006.00000002.2948861525.00007FFDFA1F8000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: UpdaterTool.exe, 00000001.00000002.2944468574.0000020DC7F90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
Source: UpdaterTool.exe, 00000001.00000002.2944468574.0000020DC7F90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-errorr
Source: UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/cryptography/
Source: UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: UpdaterTool.exe, 00000001.00000003.1710963005.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1707894054.0000020DC74D9000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714594509.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1709162511.0000020DC74CD000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710428295.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708023539.0000020DC74D0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708023539.0000020DC7474000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944468574.0000020DC7F90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708607542.0000020DC74D0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1784855892.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788526301.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786187452.00000222A48F1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1784855892.00000222A4900000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: UpdaterTool.exe, 00000001.00000002.2944468574.0000020DC7F90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.ioxe
Source: UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7A9C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2945655139.0000020DC8890000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: UpdaterTool.exe, 00000001.00000003.1710963005.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714594509.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710428295.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788526301.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786187452.00000222A48F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC73FD000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714881533.0000020DC73F4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1709162511.0000020DC740C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1784298765.00000222A4897000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788159871.00000222A489D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC789C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786586199.00000222A4E19000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1790132663.00000222A4E21000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787859354.00000222A4E1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: UpdaterTool.exe, 00000001.00000002.2941750370.0000020DC7690000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941277308.00000222A4AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy
Source: UpdaterTool.exe, 00000001.00000002.2941750370.0000020DC7690000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941277308.00000222A4AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxyr
Source: UpdaterTool.exe, 00000006.00000002.2941277308.00000222A4AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings
Source: UpdaterTool.exe, 00000001.00000002.2941750370.0000020DC7690000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings0
Source: UpdaterTool.exe, 00000001.00000002.2941750370.0000020DC7690000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941277308.00000222A4AF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warningsThe
Source: UpdaterTool.exe, 00000001.00000002.2943807264.0000020DC7C90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2942707407.00000222A50F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/stable/v2-migration-guide.html
Source: UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC780E000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC780E000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC780E000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788526301.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786438941.00000222A49AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/html/sec-forms.html#multipart-form-data
Source: UpdaterTool.exe, 00000000.00000003.1690535566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1768158073.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/
Source: UpdaterTool.exe, 00000000.00000003.1690535566.0000023222730000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1690597581.0000023222731000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1690535566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1768357903.0000013B22C3D000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1768158073.0000013B22C3D000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1768158073.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: UpdaterTool.exe, 00000001.00000002.2946195728.0000020DC8C24000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: UpdaterTool.exe, 00000001.00000002.2946195728.0000020DC8C24000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: UpdaterTool.exe, 00000001.00000002.2946195728.0000020DC8C24000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierra0
Source: UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2949795213.00007FFDFB244000.00000002.00000001.01000000.0000000F.sdmp, UpdaterTool.exe, 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmp, UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2950833491.00007FFDFBAC0000.00000002.00000001.01000000.00000028.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: UpdaterTool.exe, 00000001.00000003.1710963005.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1707894054.0000020DC74D9000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714594509.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1709162511.0000020DC74CD000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710428295.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708023539.0000020DC74D0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708023539.0000020DC7474000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708607542.0000020DC74D0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1784855892.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788526301.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786187452.00000222A48F1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1784855892.00000222A4900000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: UpdaterTool.exe, 00000001.00000003.1713551694.0000020DC77A2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714881533.0000020DC73F4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC7799000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4E79000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1789451791.00000222A4F9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: UpdaterTool.exe, 00000001.00000002.2950295771.00007FFDFB668000.00000002.00000001.01000000.00000004.sdmp, UpdaterTool.exe, 00000006.00000002.2948861525.00007FFDFA1F8000.00000002.00000001.01000000.0000001E.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7583000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943452738.00000222A55A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/d

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55657 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55657
Source: unknown	Network traffic detected: HTTP traffic on port 55658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55632
Source: unknown	Network traffic detected: HTTP traffic on port 55670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55677
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55670
Source: unknown	Network traffic detected: HTTP traffic on port 55677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 6_2_00007FFDFF154F70 PyArg_ParseTuple,PyEval_SaveThread,GetKeyboardState,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,

6_2_00007FFDFF154F70

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 6_2_00007FFDFF155980 PyArg_ParseTuple,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,

6_2_00007FFDFF155980

Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57A08C8	0_2_00007FF6E57A08C8
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E5781000	0_2_00007FF6E5781000
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57889E0	0_2_00007FF6E57889E0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57A6964	0_2_00007FF6E57A6964
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57A5C00	0_2_00007FF6E57A5C00
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E579DEF0	0_2_00007FF6E579DEF0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57A9728	0_2_00007FF6E57A9728
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57A5E7C	0_2_00007FF6E57A5E7C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E5799EA0	0_2_00007FF6E5799EA0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E5791D54	0_2_00007FF6E5791D54
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E579E570	0_2_00007FF6E579E570
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57935A0	0_2_00007FF6E57935A0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57980E4	0_2_00007FF6E57980E4
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57A1874	0_2_00007FF6E57A1874
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57A40AC	0_2_00007FF6E57A40AC
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E5789800	0_2_00007FF6E5789800
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E5791740	0_2_00007FF6E5791740
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E5791F60	0_2_00007FF6E5791F60
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E5798794	0_2_00007FF6E5798794
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E578A2DB	0_2_00007FF6E578A2DB
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E579DA5C	0_2_00007FF6E579DA5C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E5791944	0_2_00007FF6E5791944
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E5792164	0_2_00007FF6E5792164
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57939A4	0_2_00007FF6E57939A4
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E5795D30	0_2_00007FF6E5795D30
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E578A474	0_2_00007FF6E578A474
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E578ACAD	0_2_00007FF6E578ACAD
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E5792C10	0_2_00007FF6E5792C10
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57A3C10	0_2_00007FF6E57A3C10
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57A08C8	0_2_00007FF6E57A08C8
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57A6418	0_2_00007FF6E57A6418
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E5791B50	0_2_00007FF6E5791B50
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E5781000	1_2_00007FF6E5781000
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57A6964	1_2_00007FF6E57A6964
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E579DEF0	1_2_00007FF6E579DEF0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57A9728	1_2_00007FF6E57A9728
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57A5E7C	1_2_00007FF6E57A5E7C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E5799EA0	1_2_00007FF6E5799EA0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E5791D54	1_2_00007FF6E5791D54
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E579E570	1_2_00007FF6E579E570
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57935A0	1_2_00007FF6E57935A0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57A08C8	1_2_00007FF6E57A08C8
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57980E4	1_2_00007FF6E57980E4
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57A1874	1_2_00007FF6E57A1874
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57A40AC	1_2_00007FF6E57A40AC
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E5789800	1_2_00007FF6E5789800
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E5791740	1_2_00007FF6E5791740
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E5791F60	1_2_00007FF6E5791F60
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E5798794	1_2_00007FF6E5798794
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E578A2DB	1_2_00007FF6E578A2DB
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E579DA5C	1_2_00007FF6E579DA5C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57889E0	1_2_00007FF6E57889E0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E5791944	1_2_00007FF6E5791944
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E5792164	1_2_00007FF6E5792164
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57939A4	1_2_00007FF6E57939A4
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E5795D30	1_2_00007FF6E5795D30
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E578A474	1_2_00007FF6E578A474
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E578ACAD	1_2_00007FF6E578ACAD
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57A5C00	1_2_00007FF6E57A5C00
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E5792C10	1_2_00007FF6E5792C10
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57A3C10	1_2_00007FF6E57A3C10
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57A08C8	1_2_00007FF6E57A08C8
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57A6418	1_2_00007FF6E57A6418
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E5791B50	1_2_00007FF6E5791B50
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFABD8A30	1_2_00007FFDFABD8A30
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFABEDA90	1_2_00007FFDFABEDA90
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC01FC0	1_2_00007FFDFAC01FC0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFABF3230	1_2_00007FFDFABF3230
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFABFF690	1_2_00007FFDFABFF690
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFABF3780	1_2_00007FFDFABF3780
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFABECB70	1_2_00007FFDFABECB70
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFABEA880	1_2_00007FFDFABEA880
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFABFECC0	1_2_00007FFDFABFECC0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC02300	1_2_00007FFDFAC02300
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFABC8550	1_2_00007FFDFABC8550
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC084A0	1_2_00007FFDFAC084A0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFABD85E0	1_2_00007FFDFABD85E0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACABAE0	1_2_00007FFDFACABAE0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACC9A60	1_2_00007FFDFACC9A60
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8155A	1_2_00007FFDFAC8155A
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACC5C00	1_2_00007FFDFACC5C00
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81654	1_2_00007FFDFAC81654
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC813DE	1_2_00007FFDFAC813DE
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC821C6	1_2_00007FFDFAC821C6
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81596	1_2_00007FFDFAC81596
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACCD980	1_2_00007FFDFACCD980
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81AD7	1_2_00007FFDFAC81AD7
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81546	1_2_00007FFDFAC81546
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACA6030	1_2_00007FFDFACA6030
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACCDE50	1_2_00007FFDFACCDE50
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81FDC	1_2_00007FFDFAC81FDC
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC821E4	1_2_00007FFDFAC821E4
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC817F8	1_2_00007FFDFAC817F8
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACED2D0	1_2_00007FFDFACED2D0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC82702	1_2_00007FFDFAC82702
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC824DC	1_2_00007FFDFAC824DC
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81C12	1_2_00007FFDFAC81C12
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACF3650	1_2_00007FFDFACF3650
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81A0F	1_2_00007FFDFAC81A0F
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC82617	1_2_00007FFDFAC82617
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACB8920	1_2_00007FFDFACB8920
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81EE2	1_2_00007FFDFAC81EE2
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACF8870	1_2_00007FFDFACF8870
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81618	1_2_00007FFDFAC81618
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8117C	1_2_00007FFDFAC8117C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81CBC	1_2_00007FFDFAC81CBC
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8149C	1_2_00007FFDFAC8149C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFACFAC80	1_2_00007FFDFACFAC80
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81B54	1_2_00007FFDFAC81B54
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC81D93	1_2_00007FFDFAC81D93
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF9838A30	6_2_00007FFDF9838A30
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF984DA90	6_2_00007FFDF984DA90
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF9861FC0	6_2_00007FFDF9861FC0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF9853230	6_2_00007FFDF9853230
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF9853780	6_2_00007FFDF9853780
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF985F690	6_2_00007FFDF985F690
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF984A880	6_2_00007FFDF984A880
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF984CB70	6_2_00007FFDF984CB70
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF985ECC0	6_2_00007FFDF985ECC0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF9862300	6_2_00007FFDF9862300
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF98385E0	6_2_00007FFDF98385E0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF9828550	6_2_00007FFDF9828550
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF98684A0	6_2_00007FFDF98684A0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFB919F80	6_2_00007FFDFB919F80
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFB951300	6_2_00007FFDFB951300
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFB951950	6_2_00007FFDFB951950
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFB952270	6_2_00007FFDFB952270
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA45C00	6_2_00007FFDFBA45C00
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA0155A	6_2_00007FFDFBA0155A
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA2BAE0	6_2_00007FFDFBA2BAE0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA49A60	6_2_00007FFDFBA49A60
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA01596	6_2_00007FFDFBA01596
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA4D980	6_2_00007FFDFBA4D980
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFBA01654	6_2_00007FFDFBA01654
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFF1543F0	6_2_00007FFDFF1543F0

Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDF98389C0 appears 248 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDFACFD425 appears 40 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDFBA01325 appears 51 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDFABD89C0 appears 248 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDF9824BF0 appears 77 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDFAC81325 appears 407 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDF9824250 appears 68 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FF6E5782910 appears 34 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDFBA7D32F appears 49 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDFBA7D341 appears 164 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDFACFD341 appears 1016 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDFACFD33B appears 39 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDFACFDB03 appears 40 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDFACFD32F appears 267 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDFABC4250 appears 68 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FF6E5782710 appears 104 times
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: String function: 00007FFDFABC4BF0 appears 77 times

Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.5.dr	Static PE information: No import functions for PE file found
Source: python3.dll.0.dr	Static PE information: No import functions for PE file found

Source: UpdaterTool.exe, 00000000.00000003.1698853743.0000023222722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1699093300.000002322272F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32trace.pyd0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1699093300.0000023222722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32trace.pyd0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1697906207.0000023222722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes313.dll0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1688354629.0000023222721000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1698994694.0000023222722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1687372431.0000023222721000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32ui.pyd0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1687845661.0000023222721000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1687683597.0000023222721000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1696865157.0000023222722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepythoncom313.dll0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1688215399.0000023222721000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1694657352.0000023222722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000000.00000003.1698853743.0000023222730000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs UpdaterTool.exe
Source: UpdaterTool.exe	Binary or memory string: OriginalFilename vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2939927246.0000020DC6D70000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2953648591.00007FFE11523000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2955086595.00007FFE13306000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2954839380.00007FFE12E16000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2954963485.00007FFE130CD000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2952698909.00007FFE0E182000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: OriginalFilenamepywintypes313.dll0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: OriginalFilenamepythoncom313.dll0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2953218125.00007FFE1026A000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2954367124.00007FFE11EDE000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2949795213.00007FFDFB244000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenamelibsslH vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2954720869.00007FFE126FA000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2953844653.00007FFE117E9000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2952490537.00007FFE0E151000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2952106043.00007FFE0137C000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2954593249.00007FFE126D2000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2954224420.00007FFE11EB3000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2954032733.00007FFE11BB8000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000001.00000002.2951721234.00007FFDFB8A0000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython313.dll. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1763444136.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1776131249.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32trace.pyd0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1772487132.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1775851430.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1775275775.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes313.dll0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1762872391.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32ui.pyd0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1764762314.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1764060013.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1764918641.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1775851430.0000013B22C3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1763260702.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1774949359.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepythoncom313.dll0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1775596108.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1772919592.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1764363951.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1775978328.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1764509163.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1776131249.0000013B22C3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32trace.pyd0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1763891344.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000005.00000003.1764608058.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe	Binary or memory string: OriginalFilename vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000006.00000002.2952379972.00007FFE01223000.00000002.00000001.01000000.00000025.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000006.00000002.2939152139.00000222A2840000.00000002.00000001.01000000.00000020.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000006.00000002.2953884551.00007FFE1023D000.00000002.00000001.01000000.0000002A.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000006.00000002.2953291658.00007FFE0EA76000.00000002.00000001.01000000.0000002B.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000006.00000002.2953487775.00007FFE0EB32000.00000002.00000001.01000000.00000023.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000006.00000002.2953115710.00007FFE0C0BE000.00000002.00000001.01000000.00000021.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000006.00000002.2950833491.00007FFDFBAC0000.00000002.00000001.01000000.00000028.sdmp	Binary or memory string: OriginalFilenamelibsslH vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000006.00000002.2951315641.00007FFDFF6C2000.00000002.00000001.01000000.00000032.sdmp	Binary or memory string: OriginalFilenamepywintypes313.dll0 vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000006.00000002.2950543374.00007FFDFB9FC000.00000002.00000001.01000000.0000002E.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000006.00000002.2954071172.00007FFE11076000.00000002.00000001.01000000.00000026.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000006.00000002.2952203203.00007FFE00753000.00000002.00000001.01000000.00000024.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000006.00000002.2953686422.00007FFE101EA000.00000002.00000001.01000000.0000001F.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000006.00000002.2951979065.00007FFE0048A000.00000002.00000001.01000000.00000027.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs UpdaterTool.exe
Source: UpdaterTool.exe, 00000006.00000002.2951114413.00007FFDFF171000.00000002.00000001.01000000.00000034.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs UpdaterTool.exe

Source: classification engine

Classification label: mal80.troj.evad.winEXE@31/89@11/9

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 6_2_00007FFDFF154C00 _Py_NoneStruct,PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,GetDiskFreeSpaceW,PyEval_RestoreThread,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,Py_BuildValue,

6_2_00007FFDFF154C00

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 1_2_00007FFDFABD1330 PyArg_ParseTuple,?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z,?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z,PyObject_IsInstance,PyErr_Occurred,PyExc_TypeError,PyErr_SetString,PyObject_IsInstance,PyExc_ValueError,PyErr_Format,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_GetAttrString,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyObject_IsInstance,PyExc_ValueError,PyErr_Format,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,_Py_Dealloc,PyEval_SaveThread,CoCreateInstance,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,

1_2_00007FFDFABD1330

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 6_2_00007FFDFF15CBB0 PyArg_ParseTuple,?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z,?PyWinObject_AsResourceId@@YAHPEAU_object@@PEAPEA_WH@Z,?PyWinObject_AsResourceId@@YAHPEAU_object@@PEAPEA_WH@Z,FindResourceExW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,SizeofResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,LoadResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,LockResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,?PyWinObject_FreeResourceId@@YAXPEA_W@Z,?PyWinObject_FreeResourceId@@YAXPEA_W@Z,

6_2_00007FFDFF15CBB0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7516:120:WilError_03

Source: C:\Users\user\Desktop\UpdaterTool.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI74322

Jump to behavior

Source: UpdaterTool.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\UpdaterTool.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor

Source: C:\Users\user\Desktop\UpdaterTool.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: UpdaterTool.exe

ReversingLabs: Detection: 15%

Source: C:\Users\user\Desktop\UpdaterTool.exe

File read: C:\Users\user\Desktop\UpdaterTool.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\UpdaterTool.exe "C:\Users\user\Desktop\UpdaterTool.exe"
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process created: C:\Users\user\Desktop\UpdaterTool.exe "C:\Users\user\Desktop\UpdaterTool.exe"
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST
Source: unknown	Process created: C:\Users\user\Desktop\UpdaterTool.exe C:\Users\user\Desktop\UpdaterTool.exe
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process created: C:\Users\user\Desktop\UpdaterTool.exe C:\Users\user\Desktop\UpdaterTool.exe
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://alert-metamask.info/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1788,i,3885513550755460943,12905883307123306454,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process created: C:\Users\user\Desktop\UpdaterTool.exe "C:\Users\user\Desktop\UpdaterTool.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST"	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://alert-metamask.info/	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process created: C:\Users\user\Desktop\UpdaterTool.exe C:\Users\user\Desktop\UpdaterTool.exe	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1788,i,3885513550755460943,12905883307123306454,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior

Source: C:\Users\user\Desktop\UpdaterTool.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\UpdaterTool.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations

Jump to behavior

Source: UpdaterTool.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: UpdaterTool.exe

Static file information: File size 16001583 > 1048576

Source: UpdaterTool.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: UpdaterTool.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: UpdaterTool.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: UpdaterTool.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: UpdaterTool.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: UpdaterTool.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: UpdaterTool.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: UpdaterTool.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2951840830.00007FFE01377000.00000002.00000001.01000000.00000014.sdmp, UpdaterTool.exe, 00000005.00000003.1775596108.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2950278609.00007FFDFB9F7000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: UpdaterTool.exe, 00000001.00000002.2949319095.00007FFDFB19A000.00000002.00000001.01000000.0000000F.sdmp, UpdaterTool.exe, 00000006.00000002.2947899878.00007FFDF9D2A000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\_win32sysloader.pdb source: UpdaterTool.exe, 00000000.00000003.1698853743.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775851430.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptography_rust.pdbc source: UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: UpdaterTool.exe, 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb** source: UpdaterTool.exe, 00000001.00000002.2952622584.00007FFE0E171000.00000002.00000001.01000000.00000018.sdmp, UpdaterTool.exe, 00000006.00000002.2951237378.00007FFDFF6B1000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2953956063.00007FFE11BB4000.00000002.00000001.01000000.00000015.sdmp, UpdaterTool.exe, 00000005.00000003.1764918641.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2952681947.00007FFE08ED4000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: crypto\bn\bn_ctx.cBN_CTX_startBN_CTX_getossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcrypto\evp\digest.cevp_md_ctx_new_exevp_md_ctx_free_algctxevp_md_init_internalEVP_DigestUpdatesizeEVP_DigestFinal_exassertion failed: mdsize <= EVP_MAX_MD_SIZEEVP_DigestFinalXOFxoflenEVP_MD_CTX_copy_exEVP_MD_CTX_ctrlmicalgssl3-msblocksizexofalgid-absentevp_md_from_algorithmupdatecrypto\evp\m_sigver.cUNDEFdo_sigver_initEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestSignEVP_DigestVerifyFinalEVP_DigestVerifycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Fri Oct 18 00:15:00 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb}},GCTL source: UpdaterTool.exe, 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32trace.pdb source: UpdaterTool.exe, 00000000.00000003.1699093300.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1776131249.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\engine\tb_digest.cENGINE_get_digestcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: UpdaterTool.exe, 00000000.00000003.1687683597.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2954670837.00007FFE126F4000.00000002.00000001.01000000.00000005.sdmp, UpdaterTool.exe, 00000005.00000003.1763260702.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2953613558.00007FFE101E4000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: UpdaterTool.exe, 00000001.00000002.2949319095.00007FFDFB102000.00000002.00000001.01000000.0000000F.sdmp, UpdaterTool.exe, 00000006.00000002.2947899878.00007FFDF9C92000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: UpdaterTool.exe, 00000000.00000003.1687683597.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2954670837.00007FFE126F4000.00000002.00000001.01000000.00000005.sdmp, UpdaterTool.exe, 00000005.00000003.1763260702.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2953613558.00007FFE101E4000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb!! source: UpdaterTool.exe, 00000001.00000002.2952420191.00007FFE0E143000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: UpdaterTool.exe, 00000001.00000002.2949319095.00007FFDFB19A000.00000002.00000001.01000000.0000000F.sdmp, UpdaterTool.exe, 00000006.00000002.2947899878.00007FFDF9D2A000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb source: UpdaterTool.exe, 00000001.00000002.2952420191.00007FFE0E143000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: UpdaterTool.exe, 00000000.00000003.1687845661.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2953766612.00007FFE117E5000.00000002.00000001.01000000.00000016.sdmp, UpdaterTool.exe, 00000005.00000003.1763444136.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2952491969.00007FFE02A15000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: UpdaterTool.exe, 00000000.00000003.1698192669.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2955038395.00007FFE13303000.00000002.00000001.01000000.0000000C.sdmp, UpdaterTool.exe, 00000005.00000003.1775432167.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: UpdaterTool.exe, 00000001.00000002.2954317646.00007FFE11ED3000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb source: UpdaterTool.exe, 00000001.00000002.2952622584.00007FFE0E171000.00000002.00000001.01000000.00000018.sdmp, UpdaterTool.exe, 00000006.00000002.2951237378.00007FFDFF6B1000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: UpdaterTool.exe, 00000000.00000003.1688516119.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2954912779.00007FFE130C6000.00000002.00000001.01000000.00000010.sdmp, UpdaterTool.exe, 00000005.00000003.1764236210.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2953806905.00007FFE10236000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2953528643.00007FFE1151B000.00000002.00000001.01000000.0000000A.sdmp, UpdaterTool.exe, 00000005.00000003.1764363951.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2952086765.00007FFE0074B000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: UpdaterTool.exe, 00000000.00000003.1688733443.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2954793185.00007FFE12E13000.00000002.00000001.01000000.00000011.sdmp, UpdaterTool.exe, 00000005.00000003.1764509163.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb source: UpdaterTool.exe, 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: UpdaterTool.exe, 00000000.00000003.1688628356.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2953528643.00007FFE1151B000.00000002.00000001.01000000.0000000A.sdmp, UpdaterTool.exe, 00000005.00000003.1764363951.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2952086765.00007FFE0074B000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: UpdaterTool.exe, 00000000.00000003.1687943032.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2954542077.00007FFE126CD000.00000002.00000001.01000000.00000009.sdmp, UpdaterTool.exe, 00000005.00000003.1763575144.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2953408821.00007FFE0EB2D000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: UpdaterTool.exe, 00000000.00000003.1689027621.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2953956063.00007FFE11BB4000.00000002.00000001.01000000.00000015.sdmp, UpdaterTool.exe, 00000005.00000003.1764918641.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2952681947.00007FFE08ED4000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: UpdaterTool.exe, 00000000.00000003.1688805279.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2954147891.00007FFE11EA9000.00000002.00000001.01000000.0000000B.sdmp, UpdaterTool.exe, 00000005.00000003.1764608058.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2952314784.00007FFE01219000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: cryptography_rust.pdb source: UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: UpdaterTool.exe, 00000000.00000003.1695056147.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2939927246.0000020DC6D70000.00000002.00000001.01000000.00000006.sdmp, UpdaterTool.exe, 00000005.00000003.1772919592.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939152139.00000222A2840000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: UpdaterTool.exe, 00000001.00000002.2950295771.00007FFDFB668000.00000002.00000001.01000000.00000004.sdmp, UpdaterTool.exe, 00000006.00000002.2948861525.00007FFDFA1F8000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: UpdaterTool.exe, 00000000.00000003.1687845661.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2953766612.00007FFE117E5000.00000002.00000001.01000000.00000016.sdmp, UpdaterTool.exe, 00000005.00000003.1763444136.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2952491969.00007FFE02A15000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: UpdaterTool.exe, 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: UpdaterTool.exe, 00000001.00000002.2953053216.00007FFE1024E000.00000002.00000001.01000000.0000000D.sdmp

Source: UpdaterTool.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: UpdaterTool.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: UpdaterTool.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: UpdaterTool.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: UpdaterTool.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 1_2_00007FFDFABD7B40 PyArg_ParseTuple,?PyWinLong_AsVoidPtr@@YAHPEAU_object@@PEAPEAX@Z,?PyWinLong_AsVoidPtr@@YAHPEAU_object@@PEAPEAX@Z,?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z,LoadLibraryW,GetProcAddress,PyExc_NotImplementedError,PyErr_Format,PyEval_SaveThread,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyEval_SaveThread,PyEval_RestoreThread,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyObject_IsSubclass,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,

1_2_00007FFDFABD7B40

Source: mfc140u.dll.0.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python313.dll.0.dr	Static PE information: section name: PyRuntim
Source: mfc140u.dll.5.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.5.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.5.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.5.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.5.dr	Static PE information: section name: .00cfg
Source: python313.dll.5.dr	Static PE information: section name: PyRuntim

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 1_2_00007FFDFACA4331 push rcx; ret

1_2_00007FFDFACA4332

Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\pywin32_system32\pywintypes313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\pywin32_system32\pythoncom313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\pywin32_system32\pythoncom313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\pywin32_system32\pywintypes313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76042\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74322\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 0_2_00007FF6E57876C0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF6E57876C0

Source: C:\Users\user\Desktop\UpdaterTool.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\pywin32_system32\pywintypes313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\pywin32_system32\pythoncom313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\pywin32_system32\pythoncom313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\pywin32_system32\pywintypes313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76042\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\UpdaterTool.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74322\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\UpdaterTool.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-18192

Source: C:\Users\user\Desktop\UpdaterTool.exe	API coverage: 0.9 %
Source: C:\Users\user\Desktop\UpdaterTool.exe	API coverage: 1.0 %

Source: C:\Users\user\Desktop\UpdaterTool.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E5789280 FindFirstFileExW,FindClose,	0_2_00007FF6E5789280
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57A1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6E57A1874
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E57883C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6E57883C0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E5789280 FindFirstFileExW,FindClose,	1_2_00007FF6E5789280
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57A1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6E57A1874
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E57883C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF6E57883C0

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 6_2_00007FFDFF1553D0 PyArg_ParseTuple,GetLogicalDriveStringsW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,GetLogicalDriveStringsW,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W_J@Z,

6_2_00007FFDFF1553D0

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 6_2_00007FFDFB91BEB0 _Py_NoneStruct,PyArg_ParseTuple,GetSystemInfo,VirtualAlloc,_Py_Dealloc,PyExc_MemoryError,PyErr_SetString,_PyObject_GC_New,PyExc_NotImplementedError,PyErr_Format,Py_FatalError,PyObject_GC_Track,PyExc_SystemError,PyErr_SetString,_Py_Dealloc,_Py_Dealloc,

6_2_00007FFDFB91BEB0

Source: UpdaterTool.exe, 00000000.00000003.1689528256.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1766876019.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC8375000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: UpdaterTool.exe, 00000001.00000002.2944856650.0000020DC817A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: UpdaterTool.exe, 00000001.00000002.2944856650.0000020DC81A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\/LK
Source: UpdaterTool.exe, 00000006.00000003.1788526301.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786438941.00000222A49AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS
Source: UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC8375000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:Gs
Source: UpdaterTool.exe, 00000001.00000003.1712670373.0000020DC7522000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710963005.0000020DC753F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC73FD000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714881533.0000020DC73F4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710428295.0000020DC753F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: UpdaterTool.exe, 00000001.00000002.2945655139.0000020DC8890000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ro.kernel.qemu
Source: UpdaterTool.exe, 00000001.00000002.2944856650.0000020DC81A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ro.kernel.qemur
Source: UpdaterTool.exe, 00000001.00000002.2941547478.0000020DC7590000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: hGfSingle
Source: UpdaterTool.exe, 00000001.00000002.2945655139.0000020DC8890000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dro.kernel.qemu
Source: UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8129000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\I\

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 0_2_00007FF6E579A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6E579A614

Source: C:\Users\user\Desktop\UpdaterTool.exe

1_2_00007FFDFABD7B40

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 0_2_00007FF6E57A3480 GetProcessHeap,

0_2_00007FF6E57A3480

Source: C:\Users\user\Desktop\UpdaterTool.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E579A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6E579A614
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E578D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6E578D12C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E578C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6E578C8A0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 0_2_00007FF6E578D30C SetUnhandledExceptionFilter,	0_2_00007FF6E578D30C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E579A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6E579A614
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E578D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6E578D12C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E578C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF6E578C8A0
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FF6E578D30C SetUnhandledExceptionFilter,	1_2_00007FF6E578D30C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC1B3F4 SetUnhandledExceptionFilter,	1_2_00007FFDFAC1B3F4
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC1B20C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFAC1B20C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC1A874 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFAC1A874
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFAC8212B IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFAC8212B
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF987B20C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFDF987B20C
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF987B3F4 SetUnhandledExceptionFilter,	6_2_00007FFDF987B3F4
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF987A874 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFDF987A874
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFB92A450 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFDFB92A450
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFB92AD98 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFDFB92AD98
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFB953248 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFDFB953248
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFB952C90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFDFB952C90
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFF161A98 SetUnhandledExceptionFilter,	6_2_00007FFDFF161A98
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFF160CAC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFDFF160CAC
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDFF1618B0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFDFF1618B0

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 6_2_00007FFDFF15DC70 PyArg_ParseTuple,PyEval_SaveThread,keybd_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,

6_2_00007FFDFF15DC70

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 6_2_00007FFDFF15DD10 PyArg_ParseTuple,PyEval_SaveThread,mouse_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,

6_2_00007FFDFF15DD10

Source: C:\Users\user\Desktop\UpdaterTool.exe	Process created: C:\Users\user\Desktop\UpdaterTool.exe "C:\Users\user\Desktop\UpdaterTool.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://alert-metamask.info/	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Process created: C:\Users\user\Desktop\UpdaterTool.exe C:\Users\user\Desktop\UpdaterTool.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST	Jump to behavior

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 0_2_00007FF6E57A9570 cpuid

0_2_00007FF6E57A9570

Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography-43.0.3.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography-43.0.3.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\charset_normalizer\md.cp313-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\charset_normalizer\md__mypyc.cp313-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\psutil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\psutil\_psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\win32\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\gen_py\3.13\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\gen_py\3.13\dicts.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography\hazmat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography\hazmat\bindings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography\hazmat\bindings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography\hazmat\bindings\_rust.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\_cffi_backend.cp313-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography\hazmat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography\hazmat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography\hazmat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography\hazmat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography-43.0.3.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography-43.0.3.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UpdaterTool.exe	Queries volume information: C:\Users\user\Desktop\UpdaterTool.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 0_2_00007FF6E578D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6E578D010

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 6_2_00007FFDFF154200 PyArg_ParseTuple,GetUserNameW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,

6_2_00007FFDFF154200

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 0_2_00007FF6E57A5C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF6E57A5C00

Source: C:\Users\user\Desktop\UpdaterTool.exe

Code function: 6_2_00007FFDFF157850 PyArg_ParseTuple,GetVersion,Py_BuildValue,

6_2_00007FFDFF157850

Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFABD3430 PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyObject_IsInstance,PyExc_ValueError,PyErr_Format,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,CreateBindCtx,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,PyEval_SaveThread,MkParseDisplayName,PyEval_RestoreThread,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,_Py_Dealloc,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,Py_BuildValue,	1_2_00007FFDFABD3430
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 1_2_00007FFDFABD4620 PyArg_ParseTuple,PyEval_SaveThread,CreateBindCtx,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyEval_SaveThread,PyEval_RestoreThread,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyObject_IsSubclass,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,	1_2_00007FFDFABD4620
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF9833430 PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyObject_IsInstance,PyExc_ValueError,PyErr_Format,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,CreateBindCtx,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,PyEval_SaveThread,MkParseDisplayName,PyEval_RestoreThread,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,_Py_Dealloc,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,Py_BuildValue,	6_2_00007FFDF9833430
Source: C:\Users\user\Desktop\UpdaterTool.exe	Code function: 6_2_00007FFDF9834620 PyArg_ParseTuple,PyEval_SaveThread,CreateBindCtx,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyEval_SaveThread,PyEval_RestoreThread,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyObject_IsSubclass,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,	6_2_00007FFDF9834620

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Browser Extensions	11 Process Injection	1 Virtualization/Sandbox Evasion	11 Input Capture	2 System Time Discovery	Remote Services	11 Input Capture	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	27 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UpdaterTool.exe	16%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin\mfc140u.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin\win32ui.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_cffi_backend.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\charset_normalizer\md.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\psutil\_psutil_windows.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\python313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\pywin32_system32\pythoncom313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\pywin32_system32\pywintypes313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\win32\_win32sysloader.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\win32\win32api.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74322\win32\win32trace.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\Pythonwin\mfc140u.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\Pythonwin\win32ui.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\_cffi_backend.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\charset_normalizer\md.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\psutil\_psutil_windows.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\python313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\pywin32_system32\pythoncom313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\pywin32_system32\pywintypes313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI76042\win32\_win32sysloader.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxyr	0%	Avira URL Cloud	safe
http://alert-metamask.info/	100%	Avira URL Cloud	malware
http://alert-metamask.info/583	100%	Avira URL Cloud	malware
https://wwww.certigna.fr/autorites/d	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/stable/v2-migration-guide.html	0%	Avira URL Cloud	safe
https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warningsThe	0%	Avira URL Cloud	safe
http://repository.swisssign.com/z	0%	Avira URL Cloud	safe
http://alert-metamask.info//-	100%	Avira URL Cloud	malware
http://cacerts.digix	0%	Avira URL Cloud	safe
http://alert-metamask.info//c=I	100%	Avira URL Cloud	malware
http://alert-metamask.info/w/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
metamask.io	185.199.108.153	true	false	high
alert-metamask.info	84.32.84.152	true	true	unknown
www.google.com	172.217.16.196	true	false	high
api.telegram.org	149.154.167.220	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://alert-metamask.info/	false		unknown
http://alert-metamask.info/	false	Avira URL Cloud: malware	unknown
https://metamask.io/assets/icon.svg	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/asweigart/pyperclip/issues/55	UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues/8996	UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp	false		high
https://api.telegram.org/bot	UpdaterTool.exe, 00000006.00000002.2941277308.00000222A4AF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/giampaolo/psutil/issues/875.	UpdaterTool.exe, 00000001.00000002.2945655139.0000020DC8890000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cloud.google.com/appengine/docs/standard/runtimes	UpdaterTool.exe, 00000001.00000002.2943807264.0000020DC7C90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2942707407.00000222A50F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/mhammond/pywin32	UpdaterTool.exe, UpdaterTool.exe, 00000006.00000002.2951315641.00007FFDFF6C2000.00000002.00000001.01000000.00000032.sdmp, UpdaterTool.exe, 00000006.00000002.2951114413.00007FFDFF171000.00000002.00000001.01000000.00000034.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl0	UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943452738.00000222A55A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxyr	UpdaterTool.exe, 00000001.00000002.2941750370.0000020DC7690000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941277308.00000222A4AF0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://alert-metamask.info//-	UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC83BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	UpdaterTool.exe, 00000001.00000002.2940664459.0000020DC705C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939235749.00000222A28F6000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1779370742.00000222A44E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/actions?query=workflow%3ACI	UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	false		high
http://goo.gl/zeJZl.	UpdaterTool.exe, 00000001.00000002.2945655139.0000020DC8890000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/	UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC8375000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	UpdaterTool.exe, 00000001.00000003.1710963005.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714594509.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710428295.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788526301.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786187452.00000222A48F1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/LICENSE-2.0	UpdaterTool.exe, 00000000.00000003.1690535566.0000023222730000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1690597581.0000023222731000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1690535566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1768357903.0000013B22C3D000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1768158073.0000013B22C3D000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1768158073.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	UpdaterTool.exe, 00000001.00000003.1710963005.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712670373.0000020DC7522000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714594509.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1709162511.0000020DC74CD000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710428295.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1784298765.00000222A497B000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788526301.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786187452.00000222A48F1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/	UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC8375000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cacerts.digi	UpdaterTool.exe, 00000000.00000003.1688910759.0000023222721000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1764762314.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1775596108.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot8189223637:AAFivU8R-ibjnOIJ-jbNzhmXtzM-HgY1524/sendMessage	UpdaterTool.exe, 00000001.00000002.2946195728.0000020DC8C14000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2946195728.0000020DC8BD8000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2945077322.00000222A6014000.00000004.00001000.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0205/	UpdaterTool.exe, 00000001.00000003.1700855729.0000020DC7051000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941547478.0000020DC7590000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1777328782.00000222A44B1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7583000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	UpdaterTool.exe, 00000001.00000003.1712398878.0000020DC7A64000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944280136.0000020DC7E90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711949654.0000020DC7A39000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2942856317.00000222A51F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787217256.00000222A506B000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787327944.00000222A4F64000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.accv.es	UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warningsThe	UpdaterTool.exe, 00000001.00000002.2941750370.0000020DC7690000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941277308.00000222A4AF0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6E50000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A42B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6ED4000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A4334000.00000004.00001000.00020000.00000000.sdmp	false		high
https://httpbin.org/get	UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://httpbin.org/	UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC789C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786586199.00000222A4E19000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1790132663.00000222A4E21000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787859354.00000222A4E1A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot8189223637:AAFivU8R-ibjnOIJ-jbNzhmXtzM-HgY1524/sendMessage0	UpdaterTool.exe, 00000001.00000002.2946195728.0000020DC8C14000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6E50000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A42B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7583000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943452738.00000222A55A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	UpdaterTool.exe, 00000001.00000002.2940664459.0000020DC705C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939235749.00000222A28F6000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1779370742.00000222A44E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	UpdaterTool.exe, 00000001.00000003.1710393826.0000020DC7916000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710255818.0000020DC786B000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2940664459.0000020DC705C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710206198.0000020DC7916000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1785765333.00000222A4E9F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788159871.00000222A489D000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788795117.00000222A4E9F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787859354.00000222A4E9F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1785862423.00000222A4DFE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mail.python.org/pipermail/python-dev/2012-June/120787.html.	UpdaterTool.exe, 00000001.00000002.2944468574.0000020DC7F90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://httpbin.org/	UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC789C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786586199.00000222A4E19000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1790132663.00000222A4E21000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787859354.00000222A4E1A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/	UpdaterTool.exe, 00000000.00000003.1690535566.0000023222722000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1768158073.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main	UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/	UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6E50000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A42B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6E50000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A42B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC782A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC782A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC782A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/installation/	UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	UpdaterTool.exe, 00000001.00000002.2940664459.0000020DC705C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939235749.00000222A28F6000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1779370742.00000222A44E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/z	UpdaterTool.exe, 00000006.00000002.2941724108.00000222A505E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/STCA.crl	UpdaterTool.exe, 00000006.00000002.2941724108.00000222A50B6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://wwwsearch.sf.net/):	UpdaterTool.exe, 00000001.00000003.1712670373.0000020DC7522000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714594509.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712398878.0000020DC7A64000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711949654.0000020DC7A39000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787217256.00000222A506B000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787327944.00000222A4F64000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/d	UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python/importlib_metadata/wiki/Development-Methodology	UpdaterTool.exe, 00000001.00000002.2944468574.0000020DC7F90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7583000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm	UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	UpdaterTool.exe, 00000001.00000002.2941750370.0000020DC7690000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941277308.00000222A4AF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/security/	UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cffi.readthedocs.io/en/latest/using.html#callbacks	UpdaterTool.exe	false		high
http://crl.xrampsecurity.com/XGCA.crl0	UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://alert-metamask.info/583	UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC8375000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.cert.fnmt.es/dpcs/	UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es00	UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7583000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/)	UpdaterTool.exe, 00000001.00000002.2950295771.00007FFDFB668000.00000002.00000001.01000000.00000004.sdmp, UpdaterTool.exe, 00000006.00000002.2948861525.00007FFDFA1F8000.00000002.00000001.01000000.0000001E.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	UpdaterTool.exe, 00000006.00000003.1779370742.00000222A44E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues	UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl~	UpdaterTool.exe, 00000006.00000002.2941724108.00000222A50B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://readthedocs.org/projects/cryptography/badge/?version=latest	UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC782A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC78A4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC782A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC782A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710255818.0000020DC786B000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710255818.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788526301.00000222A49E3000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787282619.00000222A49E3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	UpdaterTool.exe, 00000006.00000003.1787859354.00000222A4E1A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788159871.00000222A489D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	UpdaterTool.exe, 00000001.00000003.1713551694.0000020DC77A2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714881533.0000020DC73F4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC7799000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4E79000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1789451791.00000222A4F9C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/stable/v2-migration-guide.html	UpdaterTool.exe, 00000001.00000002.2943807264.0000020DC7C90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2942707407.00000222A50F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/SGCA.crl	UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A50B6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.../back.jpeg	UpdaterTool.exe, 00000001.00000002.2944280136.0000020DC7E90000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc7231#section-4.3.6)	UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC73FD000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714881533.0000020DC73F4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1709162511.0000020DC740C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1784298765.00000222A4897000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788159871.00000222A489D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography	UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/	UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy	UpdaterTool.exe, 00000001.00000002.2941750370.0000020DC7690000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941277308.00000222A4AF0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://httpbin.org/post	UpdaterTool.exe, 00000001.00000003.1710963005.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1707894054.0000020DC74D9000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714594509.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1709162511.0000020DC74CD000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710428295.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708023539.0000020DC74D0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708023539.0000020DC7474000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708607542.0000020DC74D0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1784855892.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788526301.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786187452.00000222A48F1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1784855892.00000222A4900000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error	UpdaterTool.exe, 00000001.00000002.2944468574.0000020DC7F90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6ED4000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A4334000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/	UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Ousret/charset_normalizer	UpdaterTool.exe, 00000001.00000003.1714079036.0000020DC795F000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC791D000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4E79000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/497	UpdaterTool.exe, 00000006.00000002.2942707407.00000222A50F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.firmaprofesional.com/cps0	UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943452738.00000222A55A1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cacerts.digix	UpdaterTool.exe, 00000000.00000003.1698330367.0000023222722000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	UpdaterTool.exe, 00000001.00000002.2940116136.0000020DC6E50000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939755632.00000222A42B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://alert-metamask.info//c=I	UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC83A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.securetrust.com/SGCA.crl0	UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	UpdaterTool.exe, 00000001.00000002.2939393895.0000020DC5477000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2939235749.00000222A28F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://yahoo.com/	UpdaterTool.exe, 00000001.00000003.1710963005.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712670373.0000020DC7522000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714594509.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710329227.0000020DC789C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710428295.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710255818.0000020DC788C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A4DA1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786586199.00000222A4E19000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1790132663.00000222A4E21000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1787859354.00000222A4E1A000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788159871.00000222A489D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC73FD000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714881533.0000020DC73F4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1785862423.00000222A4D67000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A47F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://w3c.github.io/html/sec-forms.html#multipart-form-data	UpdaterTool.exe, 00000001.00000003.1713285468.0000020DC780E000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1712021841.0000020DC780E000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2942191419.0000020DC7790000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714906217.0000020DC780E000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788526301.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786438941.00000222A49AB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps0	UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A505E000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A50B6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	UpdaterTool.exe, 00000001.00000002.2944680554.0000020DC8090000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2941724108.00000222A50B6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7583000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/changelog/	UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	false		high
http://alert-metamask.info/w/	UpdaterTool.exe, 00000001.00000002.2945396557.0000020DC83BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/pyca/cryptography/issues/9253	UpdaterTool.exe, 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmp	false		high
https://mail.python.org/mailman/listinfo/cryptography-dev	UpdaterTool.exe, 00000000.00000003.1689950392.0000023222724000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000005.00000003.1767773646.0000013B22C31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://requests.readthedocs.io	UpdaterTool.exe, 00000001.00000003.1710963005.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1707894054.0000020DC74D9000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2941160126.0000020DC7390000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1714594509.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1709162511.0000020DC74CD000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1710428295.0000020DC74A5000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708023539.0000020DC74D0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708023539.0000020DC7474000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1711501018.0000020DC743C000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000002.2944468574.0000020DC7F90000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000001.00000003.1708607542.0000020DC74D0000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1784855892.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1788526301.00000222A48E4000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2940719325.00000222A48D2000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1786187452.00000222A48F1000.00000004.00000020.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000002.2943221448.00000222A53F0000.00000004.00001000.00020000.00000000.sdmp, UpdaterTool.exe, 00000006.00000003.1784855892.00000222A4900000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.199.111.153	unknown	Netherlands	54113	FASTLYUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
92.113.16.253	unknown	Ukraine	6849	UKRTELNETUA	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
84.32.84.152	alert-metamask.info	Lithuania	33922	NTT-LT-ASLT	true
185.199.108.153	metamask.io	Netherlands	54113	FASTLYUS	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.24

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584834
Start date and time:	2025-01-06 15:59:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UpdaterTool.exe
Detection:	MAL
Classification:	mal80.troj.evad.winEXE@31/89@11/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 192.229.221.95, 142.250.185.195, 142.250.185.206, 74.125.206.84, 142.250.185.110, 142.250.185.78, 172.217.16.202, 142.250.186.35, 142.250.185.174, 142.250.186.174, 142.250.184.206, 142.250.184.238, 142.250.186.78, 142.250.186.131, 142.250.181.238, 52.149.20.212, 13.107.246.45, 23.56.254.164
Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:00:07	Task Scheduler	Run new task: SystemUpdateTask path: C:\Users\user\Desktop\UpdaterTool.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse
239.255.255.250	https://g248jqtc.r.ap-south-1.awstrack.me/L0/https:%2F%2Ffub.direct%2F1%2Fwpcpz2KV6CJLjr9Ku5V9crqS4vRSbleRYVQVlbRDO0VhTlcqWS8eK4WwWGYEcIFo0NTTfcu_ywSiT_-hMwRGjBfgg1rcvHOcCbgDl1KQiWE%2Fhttps%2Fwestcommerce.com.br%2Fe63a%2F3274607708%2FSmartadvocate%2F%23%3Fnl=ZGF5aGFuYXJhQHNtYXJ0YWR2b2NhdGUuY29t/1/010901943144e678-be97f397-fbf4-4935-81cc-f9ffe0e007ba-000000/Ra9zEF9F5Gh7LdH-GSmxaBW3ylU=188	Get hash	malicious	ScreenConnect Tool	Browse
	https://resolute-bear-n9r6wz.mystrikingly.com/	Get hash	malicious	Unknown	Browse
	https://forms.gle/XsPfAF5jPgqSvvp87	Get hash	malicious	Unknown	Browse
	https://forms.gle/XsPfAF5jPgqSvvp87	Get hash	malicious	Unknown	Browse
	https://sendbot.me/mousse-w0fysl7	Get hash	malicious	Unknown	Browse
	http://gleapis.com/	Get hash	malicious	Unknown	Browse
	http://jennadewanunwrapped.net	Get hash	malicious	Unknown	Browse
	http://103-198-26-128.hinet-ip.hinet.net/wp/plugins/Tracking/click/php/SuperTracking.html#UUJWakY1bVdkWlZQejIwbVl3cDFHb2haOENXZVhYZlpLTUNSU2x1eEVCdGJtbVhKT0ZWNkVTNjlQSXJDLzI3ekErVVlzTkFZbkh5T29jeG1LcWM4YkJUekd2M2h4amIxRWZ4am4va3cvOVk9	Get hash	malicious	Unknown	Browse
	Profile Illustrations and Technical Specifications for This System1.html	Get hash	malicious	HTMLPhisher	Browse
	https://g248jqtc.r.ap-south-1.awstrack.me/L0/https:%2F%2Ffub.direct%2F1%2Fwpcpz2KV6CJLjr9Ku5V9crqS4vRSbleRYVQVlbRDO0VhTlcqWS8eK4WwWGYEcIFo0NTTfcu_ywSiT_-hMwRGjBfgg1rcvHOcCbgDl1KQiWE%2Fhttps%2Fwestcommerce.com.br%2Fe63i%2F7286520054%2FMackietransportation%2F%23%3Fnl=ZGVhbi5tYWNraWVAbWFja2lldHJhbnNwb3J0YXRpb24uY29t/1/010901943411f671-14b57a2c-4586-496c-a061-2f25bd5eed26-000000/5tAc1I97hb2OTOUlpCX6bWWJ9hY=188	Get hash	malicious	ScreenConnect Tool	Browse
185.199.111.153	http://maine619.github.io/office/	Get hash	malicious	HTMLPhisher	Browse	maine619.github.io/office/
	http://milumuduli.github.io/netflix-template	Get hash	malicious	HTMLPhisher	Browse	milumuduli.github.io/netflix-template
	http://rajdeep-006.github.io/Netflix-Clone	Get hash	malicious	HTMLPhisher	Browse	rajdeep-006.github.io/Netflix-Clone
	http://amitavadatta2004.github.io/Netflix-Clone-	Get hash	malicious	HTMLPhisher	Browse	amitavadatta2004.github.io/Netflix-Clone-
	http://sanjaygowda23.github.io/netflix-homepage	Get hash	malicious	HTMLPhisher	Browse	sanjaygowda23.github.io/netflix-homepage
	http://robinroji.github.io/netflixclonesite	Get hash	malicious	HTMLPhisher	Browse	robinroji.github.io/netflixclonesite
	http://cnfrmaccspgs0logg.github.io/	Get hash	malicious	HTMLPhisher	Browse	cnfrmaccspgs0logg.github.io/
	http://accs-homelog.github.io/	Get hash	malicious	HTMLPhisher	Browse	accs-homelog.github.io/
	http://acticityaccountactuallypages.github.io/	Get hash	malicious	Unknown	Browse	acticityaccountactuallypages.github.io/
	http://i-am-sherlocked21.github.io/netflix	Get hash	malicious	HTMLPhisher	Browse	i-am-sherlocked21.github.io/netflix

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
metamask.io	https://jotform-mailing.com/	Get hash	malicious	Unknown	Browse	104.21.64.1
	http://bafybeid2klgyiphng6ifws5s35aor57wfi3so6koe2w4ggoacn6gqghegm.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	185.199.110.153
	https://app.io-defi.com/	Get hash	malicious	Unknown	Browse	185.199.108.153
	https://metamask-support.web.app/	Get hash	malicious	Unknown	Browse	185.199.108.153
api.telegram.org	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	ZT0KQ1PC.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	149.154.167.99
NTT-LT-ASLT	Order Inquiry.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	inv#12180.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	Set-up.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	84.32.84.20
	http://tax-com.com	Get hash	malicious	Unknown	Browse	84.32.84.155
	Company Information.pdf.lnk	Get hash	malicious	Unknown	Browse	84.32.84.121
	ER4HMMzeQ3.ps1	Get hash	malicious	Unknown	Browse	84.32.84.229
	truepepe-qt.exe	Get hash	malicious	Quasar	Browse	84.32.84.101
	z1enyifdfghvhvhvhvhvhvhvhvhvhvhvhvhvhvhvh.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	profroma invoice.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
FASTLYUS	http://103-198-26-128.hinet-ip.hinet.net/wp/plugins/Tracking/click/php/SuperTracking.html#UUJWakY1bVdkWlZQejIwbVl3cDFHb2haOENXZVhYZlpLTUNSU2x1eEVCdGJtbVhKT0ZWNkVTNjlQSXJDLzI3ekErVVlzTkFZbkh5T29jeG1LcWM4YkJUekd2M2h4amIxRWZ4am4va3cvOVk9	Get hash	malicious	Unknown	Browse	151.101.195.1
	Profile Illustrations and Technical Specifications for This System1.html	Get hash	malicious	HTMLPhisher	Browse	151.101.65.229
	https://github.com/eclipse-ecal/ecal/releases/download/v5.13.3/ecal_5.13.3-win64.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	APLICATIVO-WINDOWS-NOTA-FISCAL.msi	Get hash	malicious	AteraAgent	Browse	199.232.214.172
	https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyql	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	AZfDGVWF68.pdf	Get hash	malicious	Unknown	Browse	151.101.130.217
	https://www.boulderpeptide.org/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	151.101.64.176
	https://www.scribd.com/document/787929982/script-tlsfrance	Get hash	malicious	Unknown	Browse	151.101.130.152
	https://www.calameo.com/read/005652686f8ff374103f3	Get hash	malicious	Unknown	Browse	151.101.1.194
	mr2v5o2eB3.exe	Get hash	malicious	Unknown	Browse	185.199.108.153
UKRTELNETUA	armv6l.elf	Get hash	malicious	Mirai	Browse	178.93.43.136
	armv4l.elf	Get hash	malicious	Unknown	Browse	37.55.244.200
	GYede3Gwn0.lnk	Get hash	malicious	Unknown	Browse	92.113.18.193
	botx.arm7.elf	Get hash	malicious	Mirai	Browse	92.112.91.88
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	37.53.10.72
	telnet.sh4.elf	Get hash	malicious	Unknown	Browse	46.200.20.158
	Hh8hqqbu9X.exe	Get hash	malicious	Lokibot	Browse	92.113.16.67
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	92.113.237.42
	nsharm5.elf	Get hash	malicious	Mirai	Browse	37.53.5.183
	HmP9fn8NM9.exe	Get hash	malicious	Unknown	Browse	92.113.16.201

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin\mfc140u.dll	main.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, PRYSMAX STEALER	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	user.exe	Get hash	malicious	Unknown	Browse
	DeltaX.exe	Get hash	malicious	Unknown	Browse
	zapret.exe	Get hash	malicious	Unknown	Browse
	winws1.exe	Get hash	malicious	Unknown	Browse
	zapret.exe	Get hash	malicious	Unknown	Browse
	zapret.exe	Get hash	malicious	Unknown	Browse
	discord.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin\mfc140u.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5653536
Entropy (8bit):	6.729079283804055
Encrypted:	false
SSDEEP:	49152:ULnsrdZXUTQyJa9qgUUjlQNXkW8GCBTDgHsYogTYn3s3pQMqSj+vTCfEs7ATWYls:UoJUEUYS3zUQFLOAkGkzdnEVomFHKnP+
MD5:	CD1D99DF975EE5395174DF834E82B256
SHA1:	F395ADA2EFC6433B34D5FBC5948CB47C7073FA43
SHA-256:	D8CA1DEA862085F0204680230D29BFF4D168FFF675AB4700EEAF63704D995CB3
SHA-512:	397F725E79CA2C68799CF68DFB111A1570427F3D2175D740758C387BDAA508BC9014613E997B92FC96E884F66BB17F453F8AA035731AFD022D9A4E7095616F87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: main.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: user.exe, Detection: malicious, Browse Filename: DeltaX.exe, Detection: malicious, Browse Filename: zapret.exe, Detection: malicious, Browse Filename: winws1.exe, Detection: malicious, Browse Filename: zapret.exe, Detection: malicious, Browse Filename: zapret.exe, Detection: malicious, Browse Filename: discord.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d...9.:e.........." .....(-..X)......X,.......................................V.....&~V...`A..........................................:.....h.;.......?......`=..8....V. (...PU.0p..P.5.T...........................`...8............@-.P...(.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin\win32ui.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1044992
Entropy (8bit):	6.005174713821525
Encrypted:	false
SSDEEP:	12288:cVDH7h88c4vGmhhbrGRUDG+AYZ2OWTw/3EnrE:sDHdRcgFv8qWTwco
MD5:	9AF5F53A9201B7E62AC91EDC8AB89C6A
SHA1:	4DDFE7AF2248A76B5DB90AF0EAF4C80E2B4CD6DB
SHA-256:	F84528FC136D8ABAE77543B8E9E8C9489C4495C491807907E675C15F028816F6
SHA-512:	0581BA9951452BD7B2A193B8D73573B49CB8115468B6AF8B988628670A768A6882AC4C2C9FAA559F731ADD4378DCF606C3FFEEF96AD8A479B272E6C429DC1293
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;`K.Z...Z...Z..."...Z..=/...Z.......Z..."...Z.../...Z.../...Z.../...Z...Z...\.../...Z..=/...Z..=/...Z..=/...Z..=/...Z..Rich.Z..........................PE..d...~..g.........." .....\|...r......T1....................................................`.............................................T......h............p..............0..`\......T.......................(.......8................0...........................text....z.......\|.................. ..`.rdata.............................@..@.data........P.......6..............@....pdata......p......................@..@.rsrc................z..............@..@.reloc..`\...0...^..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.701724666218339
Encrypted:	false
SSDEEP:	768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
MD5:	68156F41AE9A04D89BB6625A5CD222D4
SHA1:	3BE29D5C53808186EBA3A024BE377EE6F267C983
SHA-256:	82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
SHA-512:	F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......\|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84240
Entropy (8bit):	6.607563436050078
Encrypted:	false
SSDEEP:	1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
MD5:	CB8C06C8FA9E61E4AC5F22EEBF7F1D00
SHA1:	D8E0DFC8127749947B09F17C8848166BAC659F0D
SHA-256:	FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
SHA-512:	E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\_cffi_backend.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179200
Entropy (8bit):	6.189919896183334
Encrypted:	false
SSDEEP:	3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
MD5:	5CBA92E7C00D09A55F5CBADC8D16CD26
SHA1:	0300C6B62CD9DB98562FDD3DE32096AB194DA4C8
SHA-256:	0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
SHA-512:	7AB432C8774A10F04DDD061B57D07EBA96481B5BB8C663C6ADE500D224C6061BC15D17C74DA20A7C3CEC8BBF6453404D553EBAB22D37D67F9B163D7A15CF1DED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i..#-p.p-p.p-p.p$..p!p.p=.q/p.p=.zp)p.p=.q)p.p=.q%p.p=.q!p.pf..q)p.p9.q.p.p-p.p.p.pe..q)p.p$..p,p.pe..q,p.pe.xp,p.pe..q,p.pRich-p.p........................PE..d..._..f.........." ...).....B......@........................................0............`..........................................h..l....i..................T............ ......0O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...n..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131344
Entropy (8bit):	6.311142284249784
Encrypted:	false
SSDEEP:	3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
MD5:	A55E57D7594303C89B5F7A1D1D6F2B67
SHA1:	904A9304A07716497CF3E4EAAFD82715874C94F1
SHA-256:	F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
SHA-512:	FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	277776
Entropy (8bit):	6.5855511991551
Encrypted:	false
SSDEEP:	6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
MD5:	F3377F3DE29579140E2BBAEEFD334D4F
SHA1:	B3076C564DBDFD4CA1B7CC76F36448B0088E2341
SHA-256:	B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
SHA-512:	34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	6.220967684620152
Encrypted:	false
SSDEEP:	768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
MD5:	32D76C9ABD65A5D2671AEEDE189BC290
SHA1:	0D4440C9652B92B40BB92C20F3474F14E34F8D62
SHA-256:	838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
SHA-512:	49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157968
Entropy (8bit):	6.854644275249963
Encrypted:	false
SSDEEP:	3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
MD5:	1BA022D42024A655CF289544AE461FB8
SHA1:	9772A31083223ECF66751FF3851D2E3303A0764C
SHA-256:	D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
SHA-512:	2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....\|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33552
Entropy (8bit):	6.446391764486538
Encrypted:	false
SSDEEP:	384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
MD5:	1C03CAA59B5E4A7FB9B998D8C1DA165A
SHA1:	8A318F80A705C64076E22913C2206D9247D30CD7
SHA-256:	B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
SHA-512:	783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83728
Entropy (8bit):	6.331814573029388
Encrypted:	false
SSDEEP:	1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
MD5:	FE896371430BD9551717EF12A3E7E818
SHA1:	E2A7716E9CE840E53E8FC79D50A77F40B353C954
SHA-256:	35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
SHA-512:	67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181520
Entropy (8bit):	5.972827303352998
Encrypted:	false
SSDEEP:	3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
MD5:	1C0E3E447F719FBE2601D0683EA566FC
SHA1:	5321AB73B36675B238AB3F798C278195223CD7B1
SHA-256:	63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
SHA-512:	E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38160
Entropy (8bit):	6.338856805460127
Encrypted:	false
SSDEEP:	768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
MD5:	1C30CC7DF3BD168D883E93C593890B43
SHA1:	31465425F349DAE4EDAC9D0FEABC23CE83400807
SHA-256:	6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
SHA-512:	267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\base_library.zip

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI74322\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI74322\charset_normalizer\md.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.818583535960129
Encrypted:	false
SSDEEP:	96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
MD5:	56FE4F6C7E88212161F49E823CCC989A
SHA1:	16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
SHA-256:	002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
SHA-512:	7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	5.953784637413928
Encrypted:	false
SSDEEP:	3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
MD5:	10116447F9276F10664BA85A5614BA3A
SHA1:	EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
SHA-256:	C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
SHA-512:	C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography-43.0.3.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography-43.0.3.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	5.074230645519915
Encrypted:	false
SSDEEP:	96:DloQIUQIhQIKQILbQIRIaMPktjaVxsxA2TLLDmplH7dwnqTIvrUmA0JQTQCQx5KN:RcPuP1srTLLDmplH7JTIvYX0JQTQ9x54
MD5:	C891CD93024AF027647E6DE89D0FFCE2
SHA1:	01D8D6F93F1B922A91C82D4711BCEFB885AD47B0
SHA-256:	EB36E0E4251E8479EF36964440755EF22BEDD411BA87A93F726FA8E5BB0E64B0
SHA-512:	3386FBB3DCF7383B2D427093624C531C50BE34E3E0AA0984547B953E04776D0D431D5267827F4194A9B0AD1AB897869115623E802A6A1C5D2AE1AD82C96CCE71
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 43.0.3.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography-43.0.3.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15485
Entropy (8bit):	5.562603127346912
Encrypted:	false
SSDEEP:	192:1XxTB7oz5jF4EHRThXsI4WPm6LciTwqU+NX6in5hqw/t+B:1XX7ohCE3sIPm6LciTwqU+96inhgB
MD5:	196EB487FE23136C14B43FE28FD62DAD
SHA1:	B7878EA852FA6C6A9B173E60B81029B5B00BA691
SHA-256:	4032FF71C85740D209A454E06F96CBC56302ACEC18E1BD539D39369292DB2110
SHA-512:	F2052E1F42C8EC69DCF501FFA32B27AEC939E769786BEE1F95C24466C774987F5AA8C13B5996D6C59D04755442EB421E53E0AE5EE0148872F9BD9FE01CF3FC8E
Malicious:	false
Preview:	cryptography-43.0.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.3.dist-info/METADATA,sha256=6zbg5CUehHnvNpZEQHVe8ivt1BG6h6k_cm-o5bsOZLA,5440..cryptography-43.0.3.dist-info/RECORD,,..cryptography-43.0.3.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.3.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.3.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.3.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=-FkHKD9mSuEfH37wsSKnQzJZmL5zUAUTpB5OeUQjPE0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-313.pyc,,..cryptography/__pycache__/__init__.cpython-313.pyc,,..cryptography/__pycache__/exceptions.cpython-313.pyc,,..cryptography/__p

C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography-43.0.3.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.016084900984752
Encrypted:	false
SSDEEP:	3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
MD5:	C869D30012A100ADEB75860F3810C8C9
SHA1:	42FD5CFA75566E8A9525E087A2018E8666ED22CB
SHA-256:	F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
SHA-512:	B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography-43.0.3.dist-info\license_files\LICENSE

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography-43.0.3.dist-info\license_files\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography-43.0.3.dist-info\license_files\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI74322\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7834624
Entropy (8bit):	6.517862303223651
Encrypted:	false
SSDEEP:	49152:oFNZj7fIo9W67PapgzJTkrXyzNzpXAbuiqCgIns3mYEXEqMrIU6i7GtlqdVwASO/:QI9X/gIFYEXME+oFNr5VQCJheq4BsxH
MD5:	BFD28B03A4C32A9BCB001451FD002F67
SHA1:	DD528FD5F4775E16B2E743D3188B66F1174807B2
SHA-256:	8EF0F404A8BFF12FD6621D8F4F209499613F565777FE1C2A680E8A18F312D5A7
SHA-512:	6DC39638435F147B399826E34F78571D7ED2ED1232275E213A2B020224C0645E379F74A0CA5DE86930D3348981C8BB03BBBECFA601F8BA781417E7114662DDEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.b.6...6...6...?..$...&9..4...&9..2...&9..>...&9..'...}...8...Y<..5...6...2...~8..I...6.......~8..7...~8..7...Rich6...........PE..d......g.........." ...)..Y..$........W.......................................w...........`..........................................q.....l.q.............. s...............w......zi.T....................{i.(...Pyi.@.............Y..............................text...k.Y.......Y................. ..`.rdata...A....Y..B....Y.............@..@.data...@+....q.......q.............@....pdata....... s.......r.............@..@.reloc........w.......v.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.909456553599775
Encrypted:	false
SSDEEP:	1536:j3sHmR02IvVxv7WCyKm7c5Th4JBHTOvyyaZE:jnIvryCyKx5Th4J5OvyyO
MD5:	49AC12A1F10AB93FAFAB064FD0523A63
SHA1:	3AD6923AB0FB5D3DD9D22ED077DB15B42C2FBD4F
SHA-256:	BA033B79E858DBFCBA6BF8FB5AFE10DEFD1CB03957DBBC68E8E62E4DE6DF492D
SHA-512:	1BC0F50E0BB0A9D9DDDAD31390E5C73B0D11C2B0A8C5462065D477E93FF21F7EDC7AA2B2B36E478BE0A797A38F43E3FBEB6AAABEF0BADEC1D8D16EB73DF67255
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..5..5..5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d...._.g.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\python3.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70416
Entropy (8bit):	6.1258200129869405
Encrypted:	false
SSDEEP:	768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
MD5:	16855EBEF31C5B1EBE767F1C617645B3
SHA1:	315521F3A748ABFA35CD4D48E8DD09D0556D989B
SHA-256:	A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
SHA-512:	C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\python313.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6083856
Entropy (8bit):	6.126922729922386
Encrypted:	false
SSDEEP:	49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
MD5:	B9DE917B925DD246B709BB4233777EFD
SHA1:	775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
SHA-256:	0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
SHA-512:	F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\pywin32_system32\pythoncom313.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	678400
Entropy (8bit):	6.050905552138285
Encrypted:	false
SSDEEP:	6144:r0G3L613PCcuXLq0Qroh0abOY6RWd0GrNmFKlOKdSAjUpdc6YcAQE7KytwhrPYL+:AGm16c0QroXbWnGVlOKQpdAUmN+
MD5:	070B0C071A05B06223B927F1711E0B9C
SHA1:	C482B1E1C1CDA3E0AEB84A0C3EF315C355BA003B
SHA-256:	9D1097ABAD812B53A68C2BFCF9EFEF7559E39873950A000FAC9A7C7C5B199292
SHA-512:	D05389A078C66426EA9CA3A8DF1721ABE246F59A3684DCFA9C5B031A93D96506A0D3BB8795330CFC0E81B23BBF7D91BBDE51EFFD152A234BA5ED63673F41086B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........~..-..-..-...-...-..,..-..,..-..,..-..,..-..,..-..,..-...,..-..,..-..-...-..,...-..,..-..,..-Rich..-................PE..d......g.........." ................4........................................ ............`..........................................u...c..............l....`...{............... ..`1..T............................1..8............................................text...#........................... ..`.rdata...$.......&..................@..@.data....L..........................@....pdata...{...`...\|..................@..@.rsrc...l............4..............@..@.reloc... ......."...8..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\pywin32_system32\pywintypes313.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135680
Entropy (8bit):	6.0205382324631955
Encrypted:	false
SSDEEP:	3072:q9GPDeI1KuOQEbULZYY/r06YrqHXmZEdb/XAnLT:GgDJ1vOlbfY/rke3mZE9/XA
MD5:	2A87D04E9E7CBFF67E8EA4F6315C0EBB
SHA1:	CF5B2BB53B37087ECA18E509B8551ED5CB7575D9
SHA-256:	D011068781CFBA0955258505DBE7E5C7D3D0B955E7F7640D2F1019D425278087
SHA-512:	2138E051AC116D3ABE11101C75F8BD8388D7FBA89B15E6F82DC35FD78BDD913ED8BA468769F68440CE7834825806281AA15F0023855E3B8248266414D60A4A44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.J+.z$x.z$x.z$x...x.z$xW.%y.z$xc..x.z$xW.!y.z$xW. y.z$xW.'y.z$xN. y.z$xM.%y.z$xN.%y.z$x.z%x.z$x..-y.z$x..$y.z$x..&y.z$xRich.z$x................PE..d...X..g.........." .........................................................`............`.........................................0...lB......,....@..l.... ...............P..0....a..T............................b..8...............p............................text...9........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata....... ......................@..@.rsrc...l....@......................@..@.reloc..0....P......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\select.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30992
Entropy (8bit):	6.554484610649281
Encrypted:	false
SSDEEP:	384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
MD5:	20831703486869B470006941B4D996F2
SHA1:	28851DFD43706542CD3EF1B88B5E2749562DFEE0
SHA-256:	78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
SHA-512:	4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	709904
Entropy (8bit):	5.861739047785334
Encrypted:	false
SSDEEP:	12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
MD5:	0902D299A2A487A7B0C2D75862B13640
SHA1:	04BCBD5A11861A03A0D323A8050A677C3A88BE13
SHA-256:	2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
SHA-512:	8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\win32\_win32sysloader.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.116146861242879
Encrypted:	false
SSDEEP:	192:ketklgde+ljBEs0I62SbPbVlQmUAaPHTPMRX7aMHvcqvn7yab6x/:/d1tT0h2SbAmFaPHTmphvH6x/
MD5:	5521E251A515964D04BC90CE8A2AA24C
SHA1:	F7B4AB985DC9A1C7EF2F716999D276D126515BEC
SHA-256:	F382CFFA30F533484FA6314E90A1408F0826867D70B3320220FD86AAFAC37526
SHA-512:	FFEB0185B6D74881B3DCA25BA1B11C33CBCF3B466F3F1B888D662611925399BA2C7D8F133673474F691C068E67811A3FAD0FC057036A5B156B735019FAA882B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%g.ND..ND..ND..G<..LD...1..LD...<..LD...1..ED...1..FD...1..MD......MD..ND..dD..1..OD..1..OD..1..OD..RichND..................PE..d...\|..g.........." ......................................................................`..........................................;..`...p;..d....p..t....`..................@...\|2..T............................2..8............0..p............................text............................... ..`.rdata..4....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\win32\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	5.868928551727267
Encrypted:	false
SSDEEP:	3072:mQKZG4IWJW8E60/c0nlRVFhLaNzvX2/qQvmYbtrprA3e:ZKZG7WgdnlRVgvm/qQDtrprA
MD5:	C5067F04B506B09E48D4D07470E5A182
SHA1:	20435C1A092141CE67E943C95E5CF522762ACD91
SHA-256:	E19294BC2C145A9D87D4A2D8412830C8FF4C8C1B9AD005BD68ABD4B566AF1887
SHA-512:	56F08A5EB927921DED50E92EA972253E68C1216DAA48871B3AA9ED62DB5712E665DFDA406C73E9F33736B61ED1F0CD016E6B4FFEE0237781FB98EEB63672F81E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V............................................+.............................................Rich............PE..d......g.........." .........................................................P............`......................................... ................0..\.......X............@..X...xv..T............................;..8............0..........@....................text............................... ..`.rdata......0......................@..@.data...X(......."..................@....pdata..X...........................@..@.rsrc...\....0......................@..@.reloc..X....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74322\win32\win32trace.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.260538552870905
Encrypted:	false
SSDEEP:	384:k1CAOcv3ugutnS5nW8sHt+9Nie20T8DmDxPBQ/vMj75yn9OJg1Bl:kh/pWKJPy/0PUOJuB
MD5:	75C14B382EEF49322BB28F79DD2A7A54
SHA1:	13CCCA1F8B19D68331E7FE981113B042FAC34408
SHA-256:	5049C9956310FFC80C1C21C2D8A6562BA810E4592DB7DAD92462D238D82F65C0
SHA-512:	3182316DEF1F09FF45C87BF6A099EF4C4D0AFA0CFF073C54AB59159E79E096ADCA0C4912B1851DE42E5EE0FC5B6C4163FCCB833A4CCE8F2AA42079D0C11D0D7A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(U.F..F..F.......F...G...F...C...F...B...F...E..F.8.G...F...G...F...G...F..G...F.8.O..F.8.F..F.8.D..F.Rich.F.................PE..d...w..g.........." .....,...........(....................................................`..........................................Q..T....Q..........d....p..,....................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata..,....p.......R..............@..@.rsrc...d............X..............@..@.reloc...............\..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\Pythonwin\mfc140u.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5653536
Entropy (8bit):	6.729079283804055
Encrypted:	false
SSDEEP:	49152:ULnsrdZXUTQyJa9qgUUjlQNXkW8GCBTDgHsYogTYn3s3pQMqSj+vTCfEs7ATWYls:UoJUEUYS3zUQFLOAkGkzdnEVomFHKnP+
MD5:	CD1D99DF975EE5395174DF834E82B256
SHA1:	F395ADA2EFC6433B34D5FBC5948CB47C7073FA43
SHA-256:	D8CA1DEA862085F0204680230D29BFF4D168FFF675AB4700EEAF63704D995CB3
SHA-512:	397F725E79CA2C68799CF68DFB111A1570427F3D2175D740758C387BDAA508BC9014613E997B92FC96E884F66BB17F453F8AA035731AFD022D9A4E7095616F87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d...9.:e.........." .....(-..X)......X,.......................................V.....&~V...`A..........................................:.....h.;.......?......`=..8....V. (...PU.0p..P.5.T...........................`...8............@-.P...(.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\Pythonwin\win32ui.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1044992
Entropy (8bit):	6.005174713821525
Encrypted:	false
SSDEEP:	12288:cVDH7h88c4vGmhhbrGRUDG+AYZ2OWTw/3EnrE:sDHdRcgFv8qWTwco
MD5:	9AF5F53A9201B7E62AC91EDC8AB89C6A
SHA1:	4DDFE7AF2248A76B5DB90AF0EAF4C80E2B4CD6DB
SHA-256:	F84528FC136D8ABAE77543B8E9E8C9489C4495C491807907E675C15F028816F6
SHA-512:	0581BA9951452BD7B2A193B8D73573B49CB8115468B6AF8B988628670A768A6882AC4C2C9FAA559F731ADD4378DCF606C3FFEEF96AD8A479B272E6C429DC1293
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;`K.Z...Z...Z..."...Z..=/...Z.......Z..."...Z.../...Z.../...Z.../...Z...Z...\.../...Z..=/...Z..=/...Z..=/...Z..=/...Z..Rich.Z..........................PE..d...~..g.........." .....\|...r......T1....................................................`.............................................T......h............p..............0..`\......T.......................(.......8................0...........................text....z.......\|.................. ..`.rdata.............................@..@.data........P.......6..............@....pdata......p......................@..@.rsrc................z..............@..@.reloc..`\...0...^..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.701724666218339
Encrypted:	false
SSDEEP:	768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
MD5:	68156F41AE9A04D89BB6625A5CD222D4
SHA1:	3BE29D5C53808186EBA3A024BE377EE6F267C983
SHA-256:	82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
SHA-512:	F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......\|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84240
Entropy (8bit):	6.607563436050078
Encrypted:	false
SSDEEP:	1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
MD5:	CB8C06C8FA9E61E4AC5F22EEBF7F1D00
SHA1:	D8E0DFC8127749947B09F17C8848166BAC659F0D
SHA-256:	FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
SHA-512:	E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\_cffi_backend.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179200
Entropy (8bit):	6.189919896183334
Encrypted:	false
SSDEEP:	3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
MD5:	5CBA92E7C00D09A55F5CBADC8D16CD26
SHA1:	0300C6B62CD9DB98562FDD3DE32096AB194DA4C8
SHA-256:	0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
SHA-512:	7AB432C8774A10F04DDD061B57D07EBA96481B5BB8C663C6ADE500D224C6061BC15D17C74DA20A7C3CEC8BBF6453404D553EBAB22D37D67F9B163D7A15CF1DED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i..#-p.p-p.p-p.p$..p!p.p=.q/p.p=.zp)p.p=.q)p.p=.q%p.p=.q!p.pf..q)p.p9.q.p.p-p.p.p.pe..q)p.p$..p,p.pe..q,p.pe.xp,p.pe..q,p.pRich-p.p........................PE..d..._..f.........." ...).....B......@........................................0............`..........................................h..l....i..................T............ ......0O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...n..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131344
Entropy (8bit):	6.311142284249784
Encrypted:	false
SSDEEP:	3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
MD5:	A55E57D7594303C89B5F7A1D1D6F2B67
SHA1:	904A9304A07716497CF3E4EAAFD82715874C94F1
SHA-256:	F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
SHA-512:	FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	277776
Entropy (8bit):	6.5855511991551
Encrypted:	false
SSDEEP:	6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
MD5:	F3377F3DE29579140E2BBAEEFD334D4F
SHA1:	B3076C564DBDFD4CA1B7CC76F36448B0088E2341
SHA-256:	B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
SHA-512:	34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	6.220967684620152
Encrypted:	false
SSDEEP:	768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
MD5:	32D76C9ABD65A5D2671AEEDE189BC290
SHA1:	0D4440C9652B92B40BB92C20F3474F14E34F8D62
SHA-256:	838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
SHA-512:	49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157968
Entropy (8bit):	6.854644275249963
Encrypted:	false
SSDEEP:	3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
MD5:	1BA022D42024A655CF289544AE461FB8
SHA1:	9772A31083223ECF66751FF3851D2E3303A0764C
SHA-256:	D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
SHA-512:	2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....\|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33552
Entropy (8bit):	6.446391764486538
Encrypted:	false
SSDEEP:	384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
MD5:	1C03CAA59B5E4A7FB9B998D8C1DA165A
SHA1:	8A318F80A705C64076E22913C2206D9247D30CD7
SHA-256:	B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
SHA-512:	783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83728
Entropy (8bit):	6.331814573029388
Encrypted:	false
SSDEEP:	1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
MD5:	FE896371430BD9551717EF12A3E7E818
SHA1:	E2A7716E9CE840E53E8FC79D50A77F40B353C954
SHA-256:	35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
SHA-512:	67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181520
Entropy (8bit):	5.972827303352998
Encrypted:	false
SSDEEP:	3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
MD5:	1C0E3E447F719FBE2601D0683EA566FC
SHA1:	5321AB73B36675B238AB3F798C278195223CD7B1
SHA-256:	63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
SHA-512:	E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38160
Entropy (8bit):	6.338856805460127
Encrypted:	false
SSDEEP:	768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
MD5:	1C30CC7DF3BD168D883E93C593890B43
SHA1:	31465425F349DAE4EDAC9D0FEABC23CE83400807
SHA-256:	6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
SHA-512:	267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\base_library.zip

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI76042\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI76042\charset_normalizer\md.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.818583535960129
Encrypted:	false
SSDEEP:	96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
MD5:	56FE4F6C7E88212161F49E823CCC989A
SHA1:	16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
SHA-256:	002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
SHA-512:	7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	5.953784637413928
Encrypted:	false
SSDEEP:	3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
MD5:	10116447F9276F10664BA85A5614BA3A
SHA1:	EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
SHA-256:	C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
SHA-512:	C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography-43.0.3.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography-43.0.3.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	5.074230645519915
Encrypted:	false
SSDEEP:	96:DloQIUQIhQIKQILbQIRIaMPktjaVxsxA2TLLDmplH7dwnqTIvrUmA0JQTQCQx5KN:RcPuP1srTLLDmplH7JTIvYX0JQTQ9x54
MD5:	C891CD93024AF027647E6DE89D0FFCE2
SHA1:	01D8D6F93F1B922A91C82D4711BCEFB885AD47B0
SHA-256:	EB36E0E4251E8479EF36964440755EF22BEDD411BA87A93F726FA8E5BB0E64B0
SHA-512:	3386FBB3DCF7383B2D427093624C531C50BE34E3E0AA0984547B953E04776D0D431D5267827F4194A9B0AD1AB897869115623E802A6A1C5D2AE1AD82C96CCE71
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 43.0.3.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography-43.0.3.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15485
Entropy (8bit):	5.562603127346912
Encrypted:	false
SSDEEP:	192:1XxTB7oz5jF4EHRThXsI4WPm6LciTwqU+NX6in5hqw/t+B:1XX7ohCE3sIPm6LciTwqU+96inhgB
MD5:	196EB487FE23136C14B43FE28FD62DAD
SHA1:	B7878EA852FA6C6A9B173E60B81029B5B00BA691
SHA-256:	4032FF71C85740D209A454E06F96CBC56302ACEC18E1BD539D39369292DB2110
SHA-512:	F2052E1F42C8EC69DCF501FFA32B27AEC939E769786BEE1F95C24466C774987F5AA8C13B5996D6C59D04755442EB421E53E0AE5EE0148872F9BD9FE01CF3FC8E
Malicious:	false
Preview:	cryptography-43.0.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.3.dist-info/METADATA,sha256=6zbg5CUehHnvNpZEQHVe8ivt1BG6h6k_cm-o5bsOZLA,5440..cryptography-43.0.3.dist-info/RECORD,,..cryptography-43.0.3.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.3.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.3.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.3.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=-FkHKD9mSuEfH37wsSKnQzJZmL5zUAUTpB5OeUQjPE0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-313.pyc,,..cryptography/__pycache__/__init__.cpython-313.pyc,,..cryptography/__pycache__/exceptions.cpython-313.pyc,,..cryptography/__p

C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography-43.0.3.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.016084900984752
Encrypted:	false
SSDEEP:	3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
MD5:	C869D30012A100ADEB75860F3810C8C9
SHA1:	42FD5CFA75566E8A9525E087A2018E8666ED22CB
SHA-256:	F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
SHA-512:	B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography-43.0.3.dist-info\license_files\LICENSE

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography-43.0.3.dist-info\license_files\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography-43.0.3.dist-info\license_files\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI76042\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7834624
Entropy (8bit):	6.517862303223651
Encrypted:	false
SSDEEP:	49152:oFNZj7fIo9W67PapgzJTkrXyzNzpXAbuiqCgIns3mYEXEqMrIU6i7GtlqdVwASO/:QI9X/gIFYEXME+oFNr5VQCJheq4BsxH
MD5:	BFD28B03A4C32A9BCB001451FD002F67
SHA1:	DD528FD5F4775E16B2E743D3188B66F1174807B2
SHA-256:	8EF0F404A8BFF12FD6621D8F4F209499613F565777FE1C2A680E8A18F312D5A7
SHA-512:	6DC39638435F147B399826E34F78571D7ED2ED1232275E213A2B020224C0645E379F74A0CA5DE86930D3348981C8BB03BBBECFA601F8BA781417E7114662DDEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.b.6...6...6...?..$...&9..4...&9..2...&9..>...&9..'...}...8...Y<..5...6...2...~8..I...6.......~8..7...~8..7...Rich6...........PE..d......g.........." ...)..Y..$........W.......................................w...........`..........................................q.....l.q.............. s...............w......zi.T....................{i.(...Pyi.@.............Y..............................text...k.Y.......Y................. ..`.rdata...A....Y..B....Y.............@..@.data...@+....q.......q.............@....pdata....... s.......r.............@..@.reloc........w.......v.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.909456553599775
Encrypted:	false
SSDEEP:	1536:j3sHmR02IvVxv7WCyKm7c5Th4JBHTOvyyaZE:jnIvryCyKx5Th4J5OvyyO
MD5:	49AC12A1F10AB93FAFAB064FD0523A63
SHA1:	3AD6923AB0FB5D3DD9D22ED077DB15B42C2FBD4F
SHA-256:	BA033B79E858DBFCBA6BF8FB5AFE10DEFD1CB03957DBBC68E8E62E4DE6DF492D
SHA-512:	1BC0F50E0BB0A9D9DDDAD31390E5C73B0D11C2B0A8C5462065D477E93FF21F7EDC7AA2B2B36E478BE0A797A38F43E3FBEB6AAABEF0BADEC1D8D16EB73DF67255
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..5..5..5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d...._.g.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\python3.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70416
Entropy (8bit):	6.1258200129869405
Encrypted:	false
SSDEEP:	768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
MD5:	16855EBEF31C5B1EBE767F1C617645B3
SHA1:	315521F3A748ABFA35CD4D48E8DD09D0556D989B
SHA-256:	A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
SHA-512:	C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\python313.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6083856
Entropy (8bit):	6.126922729922386
Encrypted:	false
SSDEEP:	49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
MD5:	B9DE917B925DD246B709BB4233777EFD
SHA1:	775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
SHA-256:	0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
SHA-512:	F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\pywin32_system32\pythoncom313.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	678400
Entropy (8bit):	6.050905552138285
Encrypted:	false
SSDEEP:	6144:r0G3L613PCcuXLq0Qroh0abOY6RWd0GrNmFKlOKdSAjUpdc6YcAQE7KytwhrPYL+:AGm16c0QroXbWnGVlOKQpdAUmN+
MD5:	070B0C071A05B06223B927F1711E0B9C
SHA1:	C482B1E1C1CDA3E0AEB84A0C3EF315C355BA003B
SHA-256:	9D1097ABAD812B53A68C2BFCF9EFEF7559E39873950A000FAC9A7C7C5B199292
SHA-512:	D05389A078C66426EA9CA3A8DF1721ABE246F59A3684DCFA9C5B031A93D96506A0D3BB8795330CFC0E81B23BBF7D91BBDE51EFFD152A234BA5ED63673F41086B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........~..-..-..-...-...-..,..-..,..-..,..-..,..-..,..-..,..-...,..-..,..-..-...-..,...-..,..-..,..-Rich..-................PE..d......g.........." ................4........................................ ............`..........................................u...c..............l....`...{............... ..`1..T............................1..8............................................text...#........................... ..`.rdata...$.......&..................@..@.data....L..........................@....pdata...{...`...\|..................@..@.rsrc...l............4..............@..@.reloc... ......."...8..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\pywin32_system32\pywintypes313.dll

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135680
Entropy (8bit):	6.0205382324631955
Encrypted:	false
SSDEEP:	3072:q9GPDeI1KuOQEbULZYY/r06YrqHXmZEdb/XAnLT:GgDJ1vOlbfY/rke3mZE9/XA
MD5:	2A87D04E9E7CBFF67E8EA4F6315C0EBB
SHA1:	CF5B2BB53B37087ECA18E509B8551ED5CB7575D9
SHA-256:	D011068781CFBA0955258505DBE7E5C7D3D0B955E7F7640D2F1019D425278087
SHA-512:	2138E051AC116D3ABE11101C75F8BD8388D7FBA89B15E6F82DC35FD78BDD913ED8BA468769F68440CE7834825806281AA15F0023855E3B8248266414D60A4A44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.J+.z$x.z$x.z$x...x.z$xW.%y.z$xc..x.z$xW.!y.z$xW. y.z$xW.'y.z$xN. y.z$xM.%y.z$xN.%y.z$x.z%x.z$x..-y.z$x..$y.z$x..&y.z$xRich.z$x................PE..d...X..g.........." .........................................................`............`.........................................0...lB......,....@..l.... ...............P..0....a..T............................b..8...............p............................text...9........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata....... ......................@..@.rsrc...l....@......................@..@.reloc..0....P......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\select.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30992
Entropy (8bit):	6.554484610649281
Encrypted:	false
SSDEEP:	384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
MD5:	20831703486869B470006941B4D996F2
SHA1:	28851DFD43706542CD3EF1B88B5E2749562DFEE0
SHA-256:	78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
SHA-512:	4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	709904
Entropy (8bit):	5.861739047785334
Encrypted:	false
SSDEEP:	12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
MD5:	0902D299A2A487A7B0C2D75862B13640
SHA1:	04BCBD5A11861A03A0D323A8050A677C3A88BE13
SHA-256:	2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
SHA-512:	8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\win32\_win32sysloader.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.116146861242879
Encrypted:	false
SSDEEP:	192:ketklgde+ljBEs0I62SbPbVlQmUAaPHTPMRX7aMHvcqvn7yab6x/:/d1tT0h2SbAmFaPHTmphvH6x/
MD5:	5521E251A515964D04BC90CE8A2AA24C
SHA1:	F7B4AB985DC9A1C7EF2F716999D276D126515BEC
SHA-256:	F382CFFA30F533484FA6314E90A1408F0826867D70B3320220FD86AAFAC37526
SHA-512:	FFEB0185B6D74881B3DCA25BA1B11C33CBCF3B466F3F1B888D662611925399BA2C7D8F133673474F691C068E67811A3FAD0FC057036A5B156B735019FAA882B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%g.ND..ND..ND..G<..LD...1..LD...<..LD...1..ED...1..FD...1..MD......MD..ND..dD..1..OD..1..OD..1..OD..RichND..................PE..d...\|..g.........." ......................................................................`..........................................;..`...p;..d....p..t....`..................@...\|2..T............................2..8............0..p............................text............................... ..`.rdata..4....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\win32\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	5.868928551727267
Encrypted:	false
SSDEEP:	3072:mQKZG4IWJW8E60/c0nlRVFhLaNzvX2/qQvmYbtrprA3e:ZKZG7WgdnlRVgvm/qQDtrprA
MD5:	C5067F04B506B09E48D4D07470E5A182
SHA1:	20435C1A092141CE67E943C95E5CF522762ACD91
SHA-256:	E19294BC2C145A9D87D4A2D8412830C8FF4C8C1B9AD005BD68ABD4B566AF1887
SHA-512:	56F08A5EB927921DED50E92EA972253E68C1216DAA48871B3AA9ED62DB5712E665DFDA406C73E9F33736B61ED1F0CD016E6B4FFEE0237781FB98EEB63672F81E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V............................................+.............................................Rich............PE..d......g.........." .........................................................P............`......................................... ................0..\.......X............@..X...xv..T............................;..8............0..........@....................text............................... ..`.rdata......0......................@..@.data...X(......."..................@....pdata..X...........................@..@.rsrc...\....0......................@..@.reloc..X....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76042\win32\win32trace.pyd

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.260538552870905
Encrypted:	false
SSDEEP:	384:k1CAOcv3ugutnS5nW8sHt+9Nie20T8DmDxPBQ/vMj75yn9OJg1Bl:kh/pWKJPy/0PUOJuB
MD5:	75C14B382EEF49322BB28F79DD2A7A54
SHA1:	13CCCA1F8B19D68331E7FE981113B042FAC34408
SHA-256:	5049C9956310FFC80C1C21C2D8A6562BA810E4592DB7DAD92462D238D82F65C0
SHA-512:	3182316DEF1F09FF45C87BF6A099EF4C4D0AFA0CFF073C54AB59159E79E096ADCA0C4912B1851DE42E5EE0FC5B6C4163FCCB833A4CCE8F2AA42079D0C11D0D7A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(U.F..F..F.......F...G...F...C...F...B...F...E..F.8.G...F...G...F...G...F..G...F.8.O..F.8.F..F.8.D..F.Rich.F.................PE..d...w..g.........." .....,...........(....................................................`..........................................Q..T....Q..........d....p..,....................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata..,....p.......R..............@..@.rsrc...d............X..............@..@.reloc...............\..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gen_py\3.13\init.py

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.713840781302666
Encrypted:	false
SSDEEP:	3:S3yE25MOWrYXtHVE/DRFrgm5/gvJgXDLAUDA+ERo6+aEYqVS1f6gq1WGgVSBn:S3mSOWWHVUDjrgmxgRgzLXDA6Va8VeuR
MD5:	8C7CA775CF482C6027B4A2D3DB0F6A31
SHA1:	E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
SHA-256:	52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
SHA-512:	19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
Malicious:	false
Preview:	# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..

C:\Users\user\AppData\Local\Temp\gen_py\3.13\dicts.dat

Download File

Process:	C:\Users\user\Desktop\UpdaterTool.exe
File Type:	data
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.7219280948873625
Encrypted:	false
SSDEEP:	3:qW6:qW6
MD5:	2C7344F3031A5107275CE84AED227411
SHA1:	68ACAD72A154CBE8B2D597655FF84FD31D57C43B
SHA-256:	83CDA9FECC9C008B22C0C8E58CBCBFA577A3EF8EE9B2F983ED4A8659596D5C11
SHA-512:	F58362C70A2017875D231831AE5868DF22D0017B00098A28AACB5753432E8C4267AA7CBF6C5680FEB2DC9B7ABADE5654C3651685167CC26AA208A9EB71528BB6
Malicious:	false
Preview:	..K....}..

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3977
Entropy (8bit):	5.207873632337016
Encrypted:	false
SSDEEP:	96:vDfGHhiPpPh/H4LA0uwueD/CIarfOtGux0+nPJ+11gv2KsJQgH0Be1NdqLmuFWMn:7GHhiPpPh/YLARwueD/CIarfOt3x04PZ
MD5:	C879A582A94E772B8ED27295AE83145D
SHA1:	A12623D13C36B4A2A2BCC419330CB2D9C8FA079D
SHA-256:	11B1AAB7F9A07CBE8903D8D6EB1E6D42BE66D1BDD838C10786C1C49A2EFB36F0
SHA-512:	D113A6D3BDBAA6345BC778E15CABBFF21ED3B1B79D5E02F17BF86E96F84F7F5ECCB084CC1E3F63C58C81C5356D147A4D5371D37621D90F73F6CB868D974C5708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 22.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns:ev="http://www.w3.org/2001/xml-events".. xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 318.6 318.6".. style="enable-background:new 0 0 318.6 318.6;" xml:space="preserve">.<style type="text/css">...st0{fill:#E2761B;stroke:#E2761B;stroke-linecap:round;stroke-linejoin:round;}...st1{fill:#E4761B;stroke:#E4761B;stroke-linecap:round;stroke-linejoin:round;}...st2{fill:#D7C1B3;stroke:#D7C1B3;stroke-linecap:round;stroke-linejoin:round;}...st3{fill:#233447;stroke:#233447;stroke-linecap:round;stroke-linejoin:round;}...st4{fill:#CD6116;stroke:#CD6116;stroke-linecap:round;stroke-linejoin:round;}...st5{fill:#E4751F;stroke:#E4751F;stroke-linecap:round;stroke-linejoin:round;}...st6{fill:#F6851B;stroke:#F6851B;stroke-linecap:round;stroke-linejoin:round;}...st7{fill:#C0AD9E;

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48444, version 1.0
Category:	downloaded
Size (bytes):	48444
Entropy (8bit):	7.995593685409469
Encrypted:	true
SSDEEP:	768:dn0V9qZpy/4pR+9MzTCGXckDohHxCc/TfZQEh9UONYyPYcABoN/8rZujvB:dn0+rAmWUMooVrbZQE7NYyzABK8rQ1
MD5:	8E433C0592F77BEB6DC527D7B90BE120
SHA1:	D7402416753AE1BB4CBD4B10D33A0C10517838BD
SHA-256:	F052EE44C3728DFD23ABA8A4567150BC314D23903026FBB6AD089422C2DF56AF
SHA-512:	5E90F48B923BB95AEB49691D03DADE8825C119B2FA28977EA170C41548900F4E0165E2869F97C7A9380D7FF8FF331A1DA855500E5F7B0DFD2B9ABD77A386BBF3
Malicious:	false
URL:	https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
Preview:	wOF2.......<.......l..............................`...\..p?HVAR.m?MVAR^.`?STAT.N'&..>/l........>....0....6.$.... ........[..A.2v.6......$..e...w"../.L.p:......Tpc..8@.[5......d#d.xw..o.O3-.....%..>...%..)~p.K.J.H..S...s..z..Wa.. 0\..J.....BL;V..-.L...j....^.9..HO l..,..6.v....?....x.....m..;....a![zif...Ur...Q..P.&.I1..:n.p...j~..h...9.!....@.<.bl\|.Y?h..B.j/..rH.S%/~.^D...6..D.4G...y....Y.....=/o..W..5ryo.d?.gA]..?...1V..S......7ZJ...f....mBG[0eW....y..%B}..]? ...,sR<.y~.~.}.%.!..,X.....`...R..^....S.....u.?k.v.k..U.u..M..`!...b!..X)P...y{.........n..T+6...R......L...x}...g...].g"WT.b..h ....X...=;{w...QO.s..w..@.(,..........{.........1..@...(...\.......9..2.h9P.G........K.Dp...F..4W..ui.u...G...s..x7.?..tg..D..O.sA..t.t.4..~..e\...X.....T..kf.qfX..=^_....g"....De...x[J..A..).G.YUhR.....0.l..#&3.'.K.............$I.Pp.../.s.<@...r=..S......d..P.S.B.w.~X..ZK....h J.`A.bv,=.....>1.Ev.^..U.A. ....EU..].........dw..!$.A`..B.._.....Z~..!..J..l]r.m}m..

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3977
Entropy (8bit):	5.207873632337016
Encrypted:	false
SSDEEP:	96:vDfGHhiPpPh/H4LA0uwueD/CIarfOtGux0+nPJ+11gv2KsJQgH0Be1NdqLmuFWMn:7GHhiPpPh/YLARwueD/CIarfOt3x04PZ
MD5:	C879A582A94E772B8ED27295AE83145D
SHA1:	A12623D13C36B4A2A2BCC419330CB2D9C8FA079D
SHA-256:	11B1AAB7F9A07CBE8903D8D6EB1E6D42BE66D1BDD838C10786C1C49A2EFB36F0
SHA-512:	D113A6D3BDBAA6345BC778E15CABBFF21ED3B1B79D5E02F17BF86E96F84F7F5ECCB084CC1E3F63C58C81C5356D147A4D5371D37621D90F73F6CB868D974C5708
Malicious:	false
URL:	https://metamask.io/assets/icon.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 22.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns:ev="http://www.w3.org/2001/xml-events".. xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 318.6 318.6".. style="enable-background:new 0 0 318.6 318.6;" xml:space="preserve">.<style type="text/css">...st0{fill:#E2761B;stroke:#E2761B;stroke-linecap:round;stroke-linejoin:round;}...st1{fill:#E4761B;stroke:#E4761B;stroke-linecap:round;stroke-linejoin:round;}...st2{fill:#D7C1B3;stroke:#D7C1B3;stroke-linecap:round;stroke-linejoin:round;}...st3{fill:#233447;stroke:#233447;stroke-linecap:round;stroke-linejoin:round;}...st4{fill:#CD6116;stroke:#CD6116;stroke-linecap:round;stroke-linejoin:round;}...st5{fill:#E4751F;stroke:#E4751F;stroke-linecap:round;stroke-linejoin:round;}...st6{fill:#F6851B;stroke:#F6851B;stroke-linecap:round;stroke-linejoin:round;}...st7{fill:#C0AD9E;

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	4942
Entropy (8bit):	5.476815634898853
Encrypted:	false
SSDEEP:	96:aOEaAqOEaEFZHOEadOEa73vOEaoOEaQJc+uTOEaWNDOpaAqOpaEFZHOpadOpa73m:9AN/C734nkDGAEif73RKkG5
MD5:	EE0EE4739567861CC2E8994CF10E16F7
SHA1:	502056CC036421E3FF1FCF1F562E83437609FBB2
SHA-256:	904DC3E1BEE45978299DA81E6B6C3A731F1240118AFDE61161E2BE24C4C1031B
SHA-512:	8E1934B264043E585BDFA64067F0E82DD60D1854268E809683433766B5E3C081B7AB88D0C75AE2609552A366E84EDA3DC8E4EC29F270E4DA9572A4399CCE71B4
Malicious:	false
URL:	https://fonts.googleapis.com/css2?family=Inter:wght@400;700&display=swap
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2JL7SUc.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2ZL7SUc.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 400;. font-display: swa

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	5797
Entropy (8bit):	4.3203042304130985
Encrypted:	false
SSDEEP:	48:tVQ1GqYS6/ZqLVl3zahlq+bnNDDOWvAuaF9ooSMYbAgVskqBG8qBb78qBPY/Jv:vO6x0VlDahlq+hDGuazYHsTcrVvpYV
MD5:	EB5A16471F48503408F6F9C328D59FCF
SHA1:	50B9BA487F962708F746155301AA724F8DFF9D8F
SHA-256:	97DAD2D70939E479775CD46DE9753B21E58E231936789EC3765976EFF358A82F
SHA-512:	5E305BDB9C50B7B69F40F29378B366F08096802B89B7A1F6BA89C9FAD578D596AC49EFE8F0897FDFF495D6622F1F8F8D1ADA50F5E5CFF28178EFD7118250C437
Malicious:	false
URL:	https://alert-metamask.info/
Preview:	<!DOCTYPE html>..<html lang="en">....<head>.. <meta charset="UTF-8" />.. <meta name="viewport" content="width=device-width, initial-scale=1.0" />.. <title>MetaMask Security Notice</title>.. <link rel="icon" href="https://metamask.io/assets/icon.svg" type="image/svg+xml" />.. <style>.. @import url('https://fonts.googleapis.com/css2?family=Inter:wght@400;700&display=swap');.... body {.. margin: 0;.. padding: 0;.. background: #D32F2F;.. /* Red background */.. font-family: 'Inter', sans-serif;.. display: flex;.. align-items: center;.. justify-content: center;.. height: 100vh;.. box-sizing: border-box;.. }.... .alert-box {.. background: #fff;.. border-radius: 8px;.. box-shadow: 0 2px 12px rgba(0, 0, 0, 0.2);.. width: 800px;.. max-width: 90%;.. overflow: hidden;.. d

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.995796327595277
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UpdaterTool.exe
File size:	16'001'583 bytes
MD5:	09cb59f6bbd3558b6698d029c1daccec
SHA1:	37a081e1a56b7b3d7982b299fe91fa8635163369
SHA256:	b88638ea23c4629fc7a28953b14ffabcf9b8fa302b552930512629c2c8a5be1a
SHA512:	1270a22cd4a2cee42406fa9332061848ac5e6d895062b143209a03878f3909e058ecc09ff41f846d38e8efe14a5c4bc87541ee1c60a7e17d502985e4a5f0b9d2
SSDEEP:	393216:XVlj87d5ta63hucsXMCHWUjAcuIF//PGEXTra:XVl8ZXr3hrsXMb8V1//OGa
TLSH:	C7F63318AAD02ACEE5F35534D8E1814BD921FCE607F1CA8F97F587522E632C09D39993
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..\.Z\.Z\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z\.Z.\.Zb..[3\.Zb..[+\.ZRich*\.Z........PE..d..

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x14000cdb0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x67564FC7 [Mon Dec 9 02:02:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FDDFCCF8E2Ch
dec eax
add esp, 28h
jmp 00007FDDFCCF8A4Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FDDFCCF91F8h
test eax, eax
je 00007FDDFCCF8BF3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FDDFCCF8BD7h
dec eax
cmp ecx, eax
je 00007FDDFCCF8BE6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003577Ch], ecx
jne 00007FDDFCCF8BC0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FDDFCCF8BC9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FDDFCCF8BD9h
mov byte ptr [00035765h], 00000001h
call 00007FDDFCCF8325h
call 00007FDDFCCF9610h
test al, al
jne 00007FDDFCCF8BD6h
xor al, al
jmp 00007FDDFCCF8BE6h
call 00007FDDFCD0612Fh
test al, al
jne 00007FDDFCCF8BDBh
xor ecx, ecx
call 00007FDDFCCF9620h
jmp 00007FDDFCCF8BBCh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003572Ch], 00000000h
mov ebx, ecx
jne 00007FDDFCCF8C39h
cmp ecx, 01h
jnbe 00007FDDFCCF8C3Ch
call 00007FDDFCCF916Eh
test eax, eax
je 00007FDDFCCF8BFAh
test ebx, ebx
jne 00007FDDFCCF8BF6h
dec eax
lea ecx, dword ptr [00035716h]
call 00007FDDFCD05F22h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca5c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0xf41c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2250	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x57000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f00	0x2a000	2a7ae207b6295492e9da088072661752	False	0.5514439174107143	data	6.487454925709845	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a50	0x12c00	ab8611ba43f248db0f58c02215add553	False	0.5244661458333333	data	5.7526633002083205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2250	0x2400	f5559f14427a02f0a5dbd0dd026cae54	False	0.470703125	data	5.291665041994019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0xf41c	0xf600	455788c285fcfdcb4008bc77e762818a	False	0.803099593495935	data	7.5549760623589695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x57000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x47208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x480b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x48958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x48ec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x523ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x54994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x55a3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x55ea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x55f0c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 16:00:03.028207064 CET	49675	443	192.168.2.4	173.222.162.32
Jan 6, 2025 16:00:06.174674988 CET	49731	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:06.174722910 CET	443	49731	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:06.174787998 CET	49731	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:06.176265955 CET	49731	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:06.176281929 CET	443	49731	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:06.788800001 CET	443	49731	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:06.790724039 CET	49731	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:06.790745974 CET	443	49731	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:06.791965961 CET	443	49731	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:06.792032003 CET	49731	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:06.793286085 CET	49731	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:06.793416023 CET	443	49731	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:06.793452978 CET	49731	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:06.793467045 CET	49731	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:06.985896111 CET	49732	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:06.985944033 CET	443	49732	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:06.986030102 CET	49732	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:06.986639977 CET	49732	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:06.986654043 CET	443	49732	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:07.643723011 CET	443	49732	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:07.644252062 CET	49732	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:07.644283056 CET	443	49732	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:07.645179033 CET	443	49732	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:07.645242929 CET	49732	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:07.646296978 CET	49732	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:07.646414995 CET	443	49732	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:07.646455050 CET	49732	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:07.646475077 CET	49732	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:12.876437902 CET	49734	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:12.876475096 CET	443	49734	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:12.876580954 CET	49734	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:12.877332926 CET	49734	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:12.877346039 CET	443	49734	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:13.508335114 CET	443	49734	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:13.508949995 CET	49734	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:13.508970976 CET	443	49734	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:13.509865046 CET	443	49734	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:13.509922981 CET	49734	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:13.511123896 CET	49734	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:13.511249065 CET	443	49734	149.154.167.220	192.168.2.4
Jan 6, 2025 16:00:13.511264086 CET	49734	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:13.511295080 CET	49734	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:00:15.912167072 CET	55575	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:00:15.917721033 CET	53	55575	1.1.1.1	192.168.2.4
Jan 6, 2025 16:00:15.917836905 CET	55575	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:00:15.923634052 CET	53	55575	1.1.1.1	192.168.2.4
Jan 6, 2025 16:00:16.596751928 CET	55575	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:00:16.601880074 CET	53	55575	1.1.1.1	192.168.2.4
Jan 6, 2025 16:00:16.601955891 CET	55575	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:00:20.619266033 CET	49723	80	192.168.2.4	2.22.50.144
Jan 6, 2025 16:00:20.624182940 CET	80	49723	2.22.50.144	192.168.2.4
Jan 6, 2025 16:00:20.624234915 CET	49723	80	192.168.2.4	2.22.50.144
Jan 6, 2025 16:01:07.561090946 CET	55632	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:01:07.561137915 CET	443	55632	149.154.167.220	192.168.2.4
Jan 6, 2025 16:01:07.561235905 CET	55632	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:01:07.561810970 CET	55632	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:01:07.561837912 CET	443	55632	149.154.167.220	192.168.2.4
Jan 6, 2025 16:01:08.168236971 CET	443	55632	149.154.167.220	192.168.2.4
Jan 6, 2025 16:01:08.169229031 CET	55632	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:01:08.169245005 CET	443	55632	149.154.167.220	192.168.2.4
Jan 6, 2025 16:01:08.172152996 CET	443	55632	149.154.167.220	192.168.2.4
Jan 6, 2025 16:01:08.172209978 CET	55632	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:01:08.174335003 CET	55632	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:01:08.174480915 CET	55632	443	192.168.2.4	149.154.167.220
Jan 6, 2025 16:01:08.984165907 CET	55644	80	192.168.2.4	84.32.84.152
Jan 6, 2025 16:01:08.986016035 CET	55645	80	192.168.2.4	84.32.84.152
Jan 6, 2025 16:01:08.988985062 CET	80	55644	84.32.84.152	192.168.2.4
Jan 6, 2025 16:01:08.989057064 CET	55644	80	192.168.2.4	84.32.84.152
Jan 6, 2025 16:01:08.989310980 CET	55644	80	192.168.2.4	84.32.84.152
Jan 6, 2025 16:01:08.990786076 CET	80	55645	84.32.84.152	192.168.2.4
Jan 6, 2025 16:01:08.990947008 CET	55645	80	192.168.2.4	84.32.84.152
Jan 6, 2025 16:01:08.994090080 CET	80	55644	84.32.84.152	192.168.2.4
Jan 6, 2025 16:01:09.687978029 CET	80	55644	84.32.84.152	192.168.2.4
Jan 6, 2025 16:01:09.732738018 CET	55644	80	192.168.2.4	84.32.84.152
Jan 6, 2025 16:01:09.931617022 CET	55657	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:09.931647062 CET	443	55657	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:09.931720018 CET	55657	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:10.020104885 CET	55658	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:10.020157099 CET	443	55658	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:10.020245075 CET	55658	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:10.198491096 CET	55658	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:10.198506117 CET	443	55658	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:10.200406075 CET	55657	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:10.200418949 CET	443	55657	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:10.847616911 CET	443	55658	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:10.847939014 CET	55658	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:10.847970009 CET	443	55658	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:10.848535061 CET	443	55657	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:10.848788977 CET	55657	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:10.848810911 CET	443	55657	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:10.849010944 CET	443	55658	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:10.849072933 CET	55658	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:10.849916935 CET	443	55657	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:10.849987030 CET	55657	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:10.850541115 CET	55658	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:10.850609064 CET	443	55658	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:10.850682974 CET	55657	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:10.850750923 CET	443	55657	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:10.850909948 CET	55658	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:10.850919008 CET	443	55658	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:10.891689062 CET	55658	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:10.891789913 CET	55657	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:10.891808033 CET	443	55657	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:10.937427998 CET	55657	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:11.392786980 CET	443	55658	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:11.392847061 CET	443	55658	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:11.392889977 CET	443	55658	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:11.392926931 CET	55658	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:11.392930984 CET	443	55658	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:11.392945051 CET	443	55658	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:11.392976046 CET	55658	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:11.398755074 CET	443	55658	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:11.398818970 CET	55658	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:11.401138067 CET	55658	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:11.401151896 CET	443	55658	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:11.447361946 CET	55670	443	192.168.2.4	185.199.108.153
Jan 6, 2025 16:01:11.447385073 CET	443	55670	185.199.108.153	192.168.2.4
Jan 6, 2025 16:01:11.447464943 CET	55670	443	192.168.2.4	185.199.108.153
Jan 6, 2025 16:01:11.447707891 CET	55670	443	192.168.2.4	185.199.108.153
Jan 6, 2025 16:01:11.447725058 CET	443	55670	185.199.108.153	192.168.2.4
Jan 6, 2025 16:01:11.937446117 CET	443	55670	185.199.108.153	192.168.2.4
Jan 6, 2025 16:01:11.939723015 CET	55670	443	192.168.2.4	185.199.108.153
Jan 6, 2025 16:01:11.939743042 CET	443	55670	185.199.108.153	192.168.2.4
Jan 6, 2025 16:01:11.940787077 CET	443	55670	185.199.108.153	192.168.2.4
Jan 6, 2025 16:01:11.940870047 CET	55670	443	192.168.2.4	185.199.108.153
Jan 6, 2025 16:01:11.941997051 CET	55670	443	192.168.2.4	185.199.108.153
Jan 6, 2025 16:01:11.942056894 CET	443	55670	185.199.108.153	192.168.2.4
Jan 6, 2025 16:01:11.942194939 CET	55670	443	192.168.2.4	185.199.108.153
Jan 6, 2025 16:01:11.942200899 CET	443	55670	185.199.108.153	192.168.2.4
Jan 6, 2025 16:01:11.984234095 CET	55670	443	192.168.2.4	185.199.108.153
Jan 6, 2025 16:01:12.056004047 CET	443	55670	185.199.108.153	192.168.2.4
Jan 6, 2025 16:01:12.056109905 CET	443	55670	185.199.108.153	192.168.2.4
Jan 6, 2025 16:01:12.056133986 CET	443	55670	185.199.108.153	192.168.2.4
Jan 6, 2025 16:01:12.056191921 CET	55670	443	192.168.2.4	185.199.108.153
Jan 6, 2025 16:01:12.056221962 CET	443	55670	185.199.108.153	192.168.2.4
Jan 6, 2025 16:01:12.056235075 CET	443	55670	185.199.108.153	192.168.2.4
Jan 6, 2025 16:01:12.056262016 CET	55670	443	192.168.2.4	185.199.108.153
Jan 6, 2025 16:01:12.056288958 CET	55670	443	192.168.2.4	185.199.108.153
Jan 6, 2025 16:01:12.056889057 CET	55670	443	192.168.2.4	185.199.108.153
Jan 6, 2025 16:01:12.056904078 CET	443	55670	185.199.108.153	192.168.2.4
Jan 6, 2025 16:01:12.078309059 CET	55677	443	192.168.2.4	185.199.111.153
Jan 6, 2025 16:01:12.078351021 CET	443	55677	185.199.111.153	192.168.2.4
Jan 6, 2025 16:01:12.078496933 CET	55677	443	192.168.2.4	185.199.111.153
Jan 6, 2025 16:01:12.078807116 CET	55677	443	192.168.2.4	185.199.111.153
Jan 6, 2025 16:01:12.078815937 CET	443	55677	185.199.111.153	192.168.2.4
Jan 6, 2025 16:01:12.540036917 CET	443	55677	185.199.111.153	192.168.2.4
Jan 6, 2025 16:01:12.551825047 CET	55677	443	192.168.2.4	185.199.111.153
Jan 6, 2025 16:01:12.551863909 CET	443	55677	185.199.111.153	192.168.2.4
Jan 6, 2025 16:01:12.552970886 CET	443	55677	185.199.111.153	192.168.2.4
Jan 6, 2025 16:01:12.553072929 CET	55677	443	192.168.2.4	185.199.111.153
Jan 6, 2025 16:01:12.554833889 CET	55677	443	192.168.2.4	185.199.111.153
Jan 6, 2025 16:01:12.554900885 CET	443	55677	185.199.111.153	192.168.2.4
Jan 6, 2025 16:01:12.555002928 CET	55677	443	192.168.2.4	185.199.111.153
Jan 6, 2025 16:01:12.594645023 CET	55677	443	192.168.2.4	185.199.111.153
Jan 6, 2025 16:01:12.594671011 CET	443	55677	185.199.111.153	192.168.2.4
Jan 6, 2025 16:01:12.642641068 CET	55677	443	192.168.2.4	185.199.111.153
Jan 6, 2025 16:01:12.686109066 CET	443	55677	185.199.111.153	192.168.2.4
Jan 6, 2025 16:01:12.686172962 CET	443	55677	185.199.111.153	192.168.2.4
Jan 6, 2025 16:01:12.686217070 CET	443	55677	185.199.111.153	192.168.2.4
Jan 6, 2025 16:01:12.686278105 CET	443	55677	185.199.111.153	192.168.2.4
Jan 6, 2025 16:01:12.686304092 CET	55677	443	192.168.2.4	185.199.111.153
Jan 6, 2025 16:01:12.686359882 CET	55677	443	192.168.2.4	185.199.111.153
Jan 6, 2025 16:01:12.882513046 CET	55677	443	192.168.2.4	185.199.111.153
Jan 6, 2025 16:01:12.882543087 CET	443	55677	185.199.111.153	192.168.2.4
Jan 6, 2025 16:01:13.146289110 CET	55685	443	192.168.2.4	172.217.16.196
Jan 6, 2025 16:01:13.146307945 CET	443	55685	172.217.16.196	192.168.2.4
Jan 6, 2025 16:01:13.146531105 CET	55685	443	192.168.2.4	172.217.16.196
Jan 6, 2025 16:01:13.146828890 CET	55685	443	192.168.2.4	172.217.16.196
Jan 6, 2025 16:01:13.146840096 CET	443	55685	172.217.16.196	192.168.2.4
Jan 6, 2025 16:01:13.797843933 CET	443	55685	172.217.16.196	192.168.2.4
Jan 6, 2025 16:01:13.798547983 CET	55685	443	192.168.2.4	172.217.16.196
Jan 6, 2025 16:01:13.798569918 CET	443	55685	172.217.16.196	192.168.2.4
Jan 6, 2025 16:01:13.799634933 CET	443	55685	172.217.16.196	192.168.2.4
Jan 6, 2025 16:01:13.799700022 CET	55685	443	192.168.2.4	172.217.16.196
Jan 6, 2025 16:01:13.801106930 CET	55685	443	192.168.2.4	172.217.16.196
Jan 6, 2025 16:01:13.801175117 CET	443	55685	172.217.16.196	192.168.2.4
Jan 6, 2025 16:01:13.855648994 CET	55685	443	192.168.2.4	172.217.16.196
Jan 6, 2025 16:01:13.855662107 CET	443	55685	172.217.16.196	192.168.2.4
Jan 6, 2025 16:01:13.896459103 CET	55685	443	192.168.2.4	172.217.16.196
Jan 6, 2025 16:01:23.698246002 CET	443	55685	172.217.16.196	192.168.2.4
Jan 6, 2025 16:01:23.698306084 CET	443	55685	172.217.16.196	192.168.2.4
Jan 6, 2025 16:01:23.698507071 CET	55685	443	192.168.2.4	172.217.16.196
Jan 6, 2025 16:01:25.310750008 CET	55685	443	192.168.2.4	172.217.16.196
Jan 6, 2025 16:01:25.310772896 CET	443	55685	172.217.16.196	192.168.2.4
Jan 6, 2025 16:01:39.360726118 CET	80	55645	84.32.84.152	192.168.2.4
Jan 6, 2025 16:01:39.360806942 CET	55645	80	192.168.2.4	84.32.84.152
Jan 6, 2025 16:01:40.753561020 CET	443	55657	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:40.753632069 CET	443	55657	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:40.753715992 CET	55657	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:41.316683054 CET	55645	80	192.168.2.4	84.32.84.152
Jan 6, 2025 16:01:41.316740036 CET	55657	443	192.168.2.4	92.113.16.253
Jan 6, 2025 16:01:41.316760063 CET	443	55657	92.113.16.253	192.168.2.4
Jan 6, 2025 16:01:41.322575092 CET	80	55645	84.32.84.152	192.168.2.4
Jan 6, 2025 16:01:54.698721886 CET	55644	80	192.168.2.4	84.32.84.152
Jan 6, 2025 16:01:54.703560114 CET	80	55644	84.32.84.152	192.168.2.4
Jan 6, 2025 16:02:09.687179089 CET	80	55644	84.32.84.152	192.168.2.4
Jan 6, 2025 16:02:09.687269926 CET	55644	80	192.168.2.4	84.32.84.152

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 16:00:06.156497002 CET	59275	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:00:06.163234949 CET	53	59275	1.1.1.1	192.168.2.4
Jan 6, 2025 16:00:15.911748886 CET	53	57064	1.1.1.1	192.168.2.4
Jan 6, 2025 16:00:20.949101925 CET	138	138	192.168.2.4	192.168.2.255
Jan 6, 2025 16:01:08.754987001 CET	62913	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:01:08.755208969 CET	56877	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:01:08.794365883 CET	53	56877	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:08.798168898 CET	53	62913	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:08.812141895 CET	53	62300	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:08.993141890 CET	53	57999	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:09.698808908 CET	59398	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:01:09.699132919 CET	57901	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:01:09.738377094 CET	53	57901	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:09.877078056 CET	53	59398	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:10.297883034 CET	53	49861	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:11.437485933 CET	53687	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:01:11.437684059 CET	50332	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:01:11.442390919 CET	53	65270	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:11.444561005 CET	53	53687	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:11.446976900 CET	53	50332	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:12.065301895 CET	52634	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:01:12.065485001 CET	55933	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:01:12.072521925 CET	53	52634	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:12.077394962 CET	53	55933	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:13.138358116 CET	49544	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:01:13.138545990 CET	60994	53	192.168.2.4	1.1.1.1
Jan 6, 2025 16:01:13.145154953 CET	53	49544	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:13.145276070 CET	53	60994	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:27.567931890 CET	53	51126	1.1.1.1	192.168.2.4
Jan 6, 2025 16:01:46.548598051 CET	53	49947	1.1.1.1	192.168.2.4
Jan 6, 2025 16:02:08.419891119 CET	53	52220	1.1.1.1	192.168.2.4
Jan 6, 2025 16:02:09.090522051 CET	53	55030	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 6, 2025 16:00:06.156497002 CET	192.168.2.4	1.1.1.1	0xd12	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:08.754987001 CET	192.168.2.4	1.1.1.1	0xe6bd	Standard query (0)	alert-metamask.info	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:08.755208969 CET	192.168.2.4	1.1.1.1	0xe3d9	Standard query (0)	alert-metamask.info	65	IN (0x0001)	false
Jan 6, 2025 16:01:09.698808908 CET	192.168.2.4	1.1.1.1	0xff11	Standard query (0)	alert-metamask.info	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:09.699132919 CET	192.168.2.4	1.1.1.1	0x75b	Standard query (0)	alert-metamask.info	65	IN (0x0001)	false
Jan 6, 2025 16:01:11.437485933 CET	192.168.2.4	1.1.1.1	0x4849	Standard query (0)	metamask.io	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:11.437684059 CET	192.168.2.4	1.1.1.1	0x6f	Standard query (0)	metamask.io	65	IN (0x0001)	false
Jan 6, 2025 16:01:12.065301895 CET	192.168.2.4	1.1.1.1	0x119e	Standard query (0)	metamask.io	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:12.065485001 CET	192.168.2.4	1.1.1.1	0x34dc	Standard query (0)	metamask.io	65	IN (0x0001)	false
Jan 6, 2025 16:01:13.138358116 CET	192.168.2.4	1.1.1.1	0xe4ef	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:13.138545990 CET	192.168.2.4	1.1.1.1	0x897d	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 6, 2025 16:00:06.163234949 CET	1.1.1.1	192.168.2.4	0xd12	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:08.798168898 CET	1.1.1.1	192.168.2.4	0xe6bd	No error (0)	alert-metamask.info	84.32.84.152	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:09.877078056 CET	1.1.1.1	192.168.2.4	0xff11	No error (0)	alert-metamask.info	92.113.16.253	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:11.444561005 CET	1.1.1.1	192.168.2.4	0x4849	No error (0)	metamask.io	185.199.108.153	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:11.444561005 CET	1.1.1.1	192.168.2.4	0x4849	No error (0)	metamask.io	185.199.109.153	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:11.444561005 CET	1.1.1.1	192.168.2.4	0x4849	No error (0)	metamask.io	185.199.111.153	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:11.444561005 CET	1.1.1.1	192.168.2.4	0x4849	No error (0)	metamask.io	185.199.110.153	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:12.072521925 CET	1.1.1.1	192.168.2.4	0x119e	No error (0)	metamask.io	185.199.111.153	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:12.072521925 CET	1.1.1.1	192.168.2.4	0x119e	No error (0)	metamask.io	185.199.109.153	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:12.072521925 CET	1.1.1.1	192.168.2.4	0x119e	No error (0)	metamask.io	185.199.108.153	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:12.072521925 CET	1.1.1.1	192.168.2.4	0x119e	No error (0)	metamask.io	185.199.110.153	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:13.145154953 CET	1.1.1.1	192.168.2.4	0xe4ef	No error (0)	www.google.com	172.217.16.196	A (IP address)	IN (0x0001)	false
Jan 6, 2025 16:01:13.145276070 CET	1.1.1.1	192.168.2.4	0x897d	No error (0)	www.google.com		65	IN (0x0001)	false

HTTP Request Dependency Graph

alert-metamask.info

https:

metamask.io

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	55644	84.32.84.152	80	7120	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 16:01:08.989310980 CET	434	OUT	GET / HTTP/1.1 Host: alert-metamask.info Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 6, 2025 16:01:09.687978029 CET	1225	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 06 Jan 2025 15:01:09 GMT Content-Type: text/html Content-Length: 795 Connection: keep-alive location: https://alert-metamask.info/ platform: hostinger panel: hpanel content-security-policy: upgrade-insecure-requests Server: hcdn alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 561e9d39e9b256c8772b1c36e42f94ff-bos-edge2 x-hcdn-cache-status: MISS x-hcdn-upstream-rt: 0.219 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Jan 6, 2025 16:01:54.698721886 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	55658	92.113.16.253	443	7120	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 15:01:10 UTC	662	OUT	GET / HTTP/1.1 Host: alert-metamask.info Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 15:01:11 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 15:01:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding last-modified: Sun, 08 Dec 2024 21:45:27 GMT etag: W/"16a5-67561377-e0ad82fa1db47819;gz" platform: hostinger panel: hpanel content-security-policy: upgrade-insecure-requests Server: hcdn alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: a738841af8c5b7bf9d9b94d65ed3f048-fra-edge2 x-hcdn-cache-status: DYNAMIC x-hcdn-upstream-rt: 0.278
2025-01-06 15:01:11 UTC	875	IN	Data Raw: 31 36 61 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 65 74 61 4d 61 73 6b 20 53 65 63 75 72 69 74 79 20 4e 6f 74 69 63 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 65 74 61 6d 61 73 6b 2e 69 6f 2f 61 73 73 65 Data Ascii: 16a5<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <title>MetaMask Security Notice</title> <link rel="icon" href="https://metamask.io/asse
2025-01-06 15:01:11 UTC	1369	IN	Data Raw: 20 32 70 78 20 31 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 38 30 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 39 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 74 6f 70 2d 73 65 63 74 69 6f 6e 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0d 0a 20 20 20 20 Data Ascii: 2px 12px rgba(0, 0, 0, 0.2); width: 800px; max-width: 90%; overflow: hidden; display: flex; flex-direction: column; } .top-section { background: #fff;
2025-01-06 15:01:11 UTC	1369	IN	Data Raw: 23 33 33 33 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 62 6f 74 74 6f 6d 2d 73 65 63 74 69 6f 6e 20 61 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 37 36 44 32 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f Data Ascii: #333; margin-bottom: 10px; line-height: 1.4; font-weight: 700; } .bottom-section a { color: #1976D2; text-decoration: none; font-weight: 700; wo
2025-01-06 15:01:11 UTC	1369	IN	Data Raw: 21 3c 2f 73 70 61 6e 3e 20 45 74 68 65 72 65 75 6d 20 50 68 69 73 68 69 6e 67 20 44 65 74 65 63 74 69 6f 6e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 74 74 6f 6d 2d 73 65 63 74 69 6f 6e 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 66 66 69 63 69 61 6c 2d 6e 6f 74 65 22 3e 54 68 69 73 20 69 73 20 61 6e 20 6f 66 66 69 63 69 61 6c 20 4d 65 74 61 4d 61 73 6b 20 73 65 63 75 72 69 74 79 20 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2e 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 44 65 61 72 20 4d 65 74 61 4d 61 73 6b 20 75 73 65 72 Data Ascii: !</span> Ethereum Phishing Detection </p> </div> <div class="bottom-section"> <p class="official-note">This is an official MetaMask security notification.</p> <p> Dear MetaMask user
2025-01-06 15:01:11 UTC	828	IN	Data Raw: 3c 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 49 66 20 79 6f 75 20 68 61 76 65 20 61 6e 79 20 71 75 65 73 74 69 6f 6e 73 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 6f 66 66 69 63 69 61 6c 20 4d 65 74 61 4d 61 73 6b 20 73 75 70 70 6f 72 74 20 74 65 61 6d 2e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 64 64 69 74 69 6f 6e 61 6c 2d 6c 69 6e 6b 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 46 6f 72 20 6d 6f 72 65 20 73 65 63 75 72 69 74 79 20 74 69 70 73 2c 20 76 69 73 69 74 3a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 65 74 61 6d Data Ascii: <p> If you have any questions, please contact the official MetaMask support team. </p> <div class="additional-links"> <p>For more security tips, visit: <a href="https://metam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	55670	185.199.108.153	443	7120	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 15:01:11 UTC	589	OUT	GET /assets/icon.svg HTTP/1.1 Host: metamask.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://alert-metamask.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 15:01:12 UTC	638	IN	HTTP/1.1 200 OK Connection: close Content-Length: 3977 Server: GitHub.com Content-Type: image/svg+xml Last-Modified: Mon, 06 Jan 2025 13:19:08 GMT Access-Control-Allow-Origin: * ETag: "677bd84c-f89" expires: Mon, 06 Jan 2025 15:11:12 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: B221:359B6D:3ABCE4F:4357CB6:677BF037 Accept-Ranges: bytes Age: 0 Date: Mon, 06 Jan 2025 15:01:12 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740063-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1736175672.991762,VS0,VE16 Vary: Accept-Encoding X-Fastly-Request-ID: f0a44b704514dbc3f7ba3d779841e8ab8a2831c9
2025-01-06 15:01:12 UTC	1378	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0a 3c 21 2d 2d 20 47 65 6e 65 72 61 74 6f 72 3a 20 41 64 6f 62 65 20 49 6c 6c 75 73 74 72 61 74 6f 72 20 32 32 2e 30 2e 31 2c 20 53 56 47 20 45 78 70 6f 72 74 20 50 6c 75 67 2d 49 6e 20 2e 20 53 56 47 20 56 65 72 73 69 6f 6e 3a 20 36 2e 30 30 20 42 75 69 6c 64 20 30 29 20 20 2d 2d 3e 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 4c 61 79 65 72 5f 31 22 20 78 6d 6c 6e 73 3a 65 76 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 78 6d 6c 2d 65 76 65 6e 74 73 22 0a 09 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Generator: Adobe Illustrator 22.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) --><svg version="1.1" id="Layer_1" xmlns:ev="http://www.w3.org/2001/xml-events" xmlns="http://www.w3.org/2000/svg" xmlns:x
2025-01-06 15:01:12 UTC	1378	IN	Data Raw: 73 3d 22 73 74 31 22 20 70 6f 69 6e 74 73 3d 22 32 33 38 2e 33 2c 32 30 36 2e 38 20 32 31 31 2e 38 2c 32 34 37 2e 34 20 32 36 38 2e 35 2c 32 36 33 20 32 38 34 2e 38 2c 32 30 37 2e 37 20 09 22 2f 3e 0a 09 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 31 22 20 70 6f 69 6e 74 73 3d 22 33 33 2e 39 2c 32 30 37 2e 37 20 35 30 2e 31 2c 32 36 33 20 31 30 36 2e 38 2c 32 34 37 2e 34 20 38 30 2e 33 2c 32 30 36 2e 38 20 09 22 2f 3e 0a 09 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 31 22 20 70 6f 69 6e 74 73 3d 22 31 30 33 2e 36 2c 31 33 38 2e 32 20 38 37 2e 38 2c 31 36 32 2e 31 20 31 34 34 2e 31 2c 31 36 34 2e 36 20 31 34 32 2e 31 2c 31 30 34 2e 31 20 09 22 2f 3e 0a 09 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 31 22 20 70 6f 69 6e 74 73 Data Ascii: s="st1" points="238.3,206.8 211.8,247.4 268.5,263 284.8,207.7 "/><polygon class="st1" points="33.9,207.7 50.1,263 106.8,247.4 80.3,206.8 "/><polygon class="st1" points="103.6,138.2 87.8,162.1 144.1,164.6 142.1,104.1 "/><polygon class="st1" points
2025-01-06 15:01:12 UTC	1221	IN	Data Raw: 2e 36 20 31 37 33 2e 31 2c 32 32 37 2e 36 20 31 37 39 2e 38 2c 31 39 33 2e 35 20 09 22 2f 3e 0a 3c 2f 67 3e 0a 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 36 22 20 70 6f 69 6e 74 73 3d 22 31 37 39 2e 38 2c 31 39 33 2e 35 20 31 37 33 2e 31 2c 32 32 37 2e 36 20 31 37 37 2e 39 2c 32 33 30 2e 39 20 32 30 37 2e 31 2c 32 30 38 2e 31 20 32 30 38 2e 31 2c 31 38 35 2e 32 20 22 2f 3e 0a 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 36 22 20 70 6f 69 6e 74 73 3d 22 31 31 30 2e 36 2c 31 38 35 2e 32 20 31 31 31 2e 34 2c 32 30 38 2e 31 20 31 34 30 2e 36 2c 32 33 30 2e 39 20 31 34 35 2e 34 2c 32 32 37 2e 36 20 31 33 38 2e 38 2c 31 39 33 2e 35 20 22 2f 3e 0a 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 37 22 20 70 6f 69 6e 74 73 3d 22 31 38 30 Data Ascii: .6 173.1,227.6 179.8,193.5 "/></g><polygon class="st6" points="179.8,193.5 173.1,227.6 177.9,230.9 207.1,208.1 208.1,185.2 "/><polygon class="st6" points="110.6,185.2 111.4,208.1 140.6,230.9 145.4,227.6 138.8,193.5 "/><polygon class="st7" points="180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	55677	185.199.111.153	443	7120	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 15:01:12 UTC	350	OUT	GET /assets/icon.svg HTTP/1.1 Host: metamask.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-06 15:01:12 UTC	638	IN	HTTP/1.1 200 OK Connection: close Content-Length: 3977 Server: GitHub.com Content-Type: image/svg+xml Last-Modified: Mon, 06 Jan 2025 13:19:08 GMT Access-Control-Allow-Origin: * ETag: "677bd84c-f89" expires: Mon, 06 Jan 2025 15:11:12 GMT Cache-Control: max-age=600 x-proxy-cache: MISS X-GitHub-Request-Id: 3517:16728E:38D7CB3:3F0DD41:677BF035 Accept-Ranges: bytes Age: 0 Date: Mon, 06 Jan 2025 15:01:12 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890026-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1736175673.604995,VS0,VE18 Vary: Accept-Encoding X-Fastly-Request-ID: a151e34e3df002bf2084e88c449b15118a21e8d7
2025-01-06 15:01:12 UTC	1378	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0a 3c 21 2d 2d 20 47 65 6e 65 72 61 74 6f 72 3a 20 41 64 6f 62 65 20 49 6c 6c 75 73 74 72 61 74 6f 72 20 32 32 2e 30 2e 31 2c 20 53 56 47 20 45 78 70 6f 72 74 20 50 6c 75 67 2d 49 6e 20 2e 20 53 56 47 20 56 65 72 73 69 6f 6e 3a 20 36 2e 30 30 20 42 75 69 6c 64 20 30 29 20 20 2d 2d 3e 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 4c 61 79 65 72 5f 31 22 20 78 6d 6c 6e 73 3a 65 76 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 78 6d 6c 2d 65 76 65 6e 74 73 22 0a 09 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Generator: Adobe Illustrator 22.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) --><svg version="1.1" id="Layer_1" xmlns:ev="http://www.w3.org/2001/xml-events" xmlns="http://www.w3.org/2000/svg" xmlns:x
2025-01-06 15:01:12 UTC	1378	IN	Data Raw: 73 3d 22 73 74 31 22 20 70 6f 69 6e 74 73 3d 22 32 33 38 2e 33 2c 32 30 36 2e 38 20 32 31 31 2e 38 2c 32 34 37 2e 34 20 32 36 38 2e 35 2c 32 36 33 20 32 38 34 2e 38 2c 32 30 37 2e 37 20 09 22 2f 3e 0a 09 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 31 22 20 70 6f 69 6e 74 73 3d 22 33 33 2e 39 2c 32 30 37 2e 37 20 35 30 2e 31 2c 32 36 33 20 31 30 36 2e 38 2c 32 34 37 2e 34 20 38 30 2e 33 2c 32 30 36 2e 38 20 09 22 2f 3e 0a 09 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 31 22 20 70 6f 69 6e 74 73 3d 22 31 30 33 2e 36 2c 31 33 38 2e 32 20 38 37 2e 38 2c 31 36 32 2e 31 20 31 34 34 2e 31 2c 31 36 34 2e 36 20 31 34 32 2e 31 2c 31 30 34 2e 31 20 09 22 2f 3e 0a 09 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 31 22 20 70 6f 69 6e 74 73 Data Ascii: s="st1" points="238.3,206.8 211.8,247.4 268.5,263 284.8,207.7 "/><polygon class="st1" points="33.9,207.7 50.1,263 106.8,247.4 80.3,206.8 "/><polygon class="st1" points="103.6,138.2 87.8,162.1 144.1,164.6 142.1,104.1 "/><polygon class="st1" points
2025-01-06 15:01:12 UTC	1221	IN	Data Raw: 2e 36 20 31 37 33 2e 31 2c 32 32 37 2e 36 20 31 37 39 2e 38 2c 31 39 33 2e 35 20 09 22 2f 3e 0a 3c 2f 67 3e 0a 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 36 22 20 70 6f 69 6e 74 73 3d 22 31 37 39 2e 38 2c 31 39 33 2e 35 20 31 37 33 2e 31 2c 32 32 37 2e 36 20 31 37 37 2e 39 2c 32 33 30 2e 39 20 32 30 37 2e 31 2c 32 30 38 2e 31 20 32 30 38 2e 31 2c 31 38 35 2e 32 20 22 2f 3e 0a 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 36 22 20 70 6f 69 6e 74 73 3d 22 31 31 30 2e 36 2c 31 38 35 2e 32 20 31 31 31 2e 34 2c 32 30 38 2e 31 20 31 34 30 2e 36 2c 32 33 30 2e 39 20 31 34 35 2e 34 2c 32 32 37 2e 36 20 31 33 38 2e 38 2c 31 39 33 2e 35 20 22 2f 3e 0a 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 37 22 20 70 6f 69 6e 74 73 3d 22 31 38 30 Data Ascii: .6 173.1,227.6 179.8,193.5 "/></g><polygon class="st6" points="179.8,193.5 173.1,227.6 177.9,230.9 207.1,208.1 208.1,185.2 "/><polygon class="st6" points="110.6,185.2 111.4,208.1 140.6,230.9 145.4,227.6 138.8,193.5 "/><polygon class="st7" points="180

Target ID:	0
Start time:	10:00:00
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\UpdaterTool.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\UpdaterTool.exe"
Imagebase:	0x7ff6e5780000
File size:	16'001'583 bytes
MD5 hash:	09CB59F6BBD3558B6698D029C1DACCEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	10:00:01
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\UpdaterTool.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\UpdaterTool.exe"
Imagebase:	0x7ff6e5780000
File size:	16'001'583 bytes
MD5 hash:	09CB59F6BBD3558B6698D029C1DACCEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:00:06
Start date:	06/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST"
Imagebase:	0x7ff657640000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:00:06
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:00:06
Start date:	06/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:00:07
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\UpdaterTool.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\UpdaterTool.exe
Imagebase:	0x7ff6e5780000
File size:	16'001'583 bytes
MD5 hash:	09CB59F6BBD3558B6698D029C1DACCEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	10:00:09
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\UpdaterTool.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\UpdaterTool.exe
Imagebase:	0x7ff6e5780000
File size:	16'001'583 bytes
MD5 hash:	09CB59F6BBD3558B6698D029C1DACCEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:00:13
Start date:	06/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST"
Imagebase:	0x7ff657640000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	10:00:13
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	10:00:13
Start date:	06/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /tn "SystemUpdateTask" /tr "C:\Users\user\Desktop\UpdaterTool.exe" /sc ONLOGON /rl HIGHEST
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:01:06
Start date:	06/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://alert-metamask.info/
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	10:01:07
Start date:	06/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1788,i,3885513550755460943,12905883307123306454,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20%
Total number of Nodes:	2000
Total number of Limit Nodes:	39

Executed Functions

Function 00007FF6E57889E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E5789390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E57845F4,00000000,00007FF6E5781985), ref: 00007FF6E57893C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788A56

Part of subcall function 00007FF6E579A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E579A490

Part of subcall function 00007FF6E579871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5798783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788AE6
CreateProcessW.KERNELBASE ref: 00007FF6E5788B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788B28

Part of subcall function 00007FF6E5782C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E5783706,?,00007FF6E5783804), ref: 00007FF6E5782C9E
Part of subcall function 00007FF6E5782C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E5783706,?,00007FF6E5783804), ref: 00007FF6E5782D63
Part of subcall function 00007FF6E5782C50: MessageBoxW.USER32 ref: 00007FF6E5782D99

RegisterClassW.USER32 ref: 00007FF6E5788B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788B8B
CreateWindowExW.USER32 ref: 00007FF6E5788BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788C15
PeekMessageW.USER32 ref: 00007FF6E5788C39
TranslateMessage.USER32 ref: 00007FF6E5788C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788C51
PeekMessageW.USER32 ref: 00007FF6E5788C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788E04
GetExitCodeProcess.KERNEL32 ref: 00007FF6E5788E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF6E5783F7F), ref: 00007FF6E5788E2F

Strings

PyInstaller Onefile Hidden Window, xrefs: 00007FF6E5788B95
Failed to create child process!, xrefs: 00007FF6E5788B30
CreateProcessW, xrefs: 00007FF6E5788B37
PyInstallerOnefileHiddenWindow, xrefs: 00007FF6E5788B54

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: 0f4de297f7e2ff7164f8715b868bd954ba448a0102784f4c489f3be076bf9670
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 6CD16133A08A9286EF109F74E8643A93B60FF84F98F400235DA5DC2A95DF3DD9758706

Function 00007FF6E5781000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6E57839DE
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF6E5783A0B, 00007FF6E5783CD4, 00007FF6E5783F6B
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6E5783BE8
pyi-contents-directory, xrefs: 00007FF6E5783B8D
pyi-runtime-tmpdir, xrefs: 00007FF6E5783B68
_PYI_SPLASH_IPC, xrefs: 00007FF6E5783A23, 00007FF6E5783EF5
Could not create temporary directory!, xrefs: 00007FF6E5783CBF
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF6E5783A17, 00007FF6E5783A2F, 00007FF6E5783A9B
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6E5783EA6
Failed to remove temporary directory: %s, xrefs: 00007FF6E5783FCF
pyi-python-flag, xrefs: 00007FF6E5783AD6
VCRUNTIME140.dll, xrefs: 00007FF6E5783DB1
MEI, xrefs: 00007FF6E5783933
Failed to start splash screen!, xrefs: 00007FF6E5783ED4
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF6E5783E0A
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6E5783971
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF6E5783882, 00007FF6E57838AF
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6E5783D12
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF6E5783B32
_PYI_ARCHIVE_FILE, xrefs: 00007FF6E57838D2, 00007FF6E57839FF
Failed to load splash screen resources!, xrefs: 00007FF6E5783E85
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF6E5783D35
pyi-disable-windowed-traceback, xrefs: 00007FF6E5783BB2
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6E5783C61
Py_GIL_DISABLED, xrefs: 00007FF6E5783AF4
pkg, xrefs: 00007FF6E57839BE
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6E5783EBB
Failed to convert DLL search path!, xrefs: 00007FF6E5783DDC

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 0fc2a62b29909a6a0d3f044a1fbc6a2b647256b24c01ebaaa7850baca27c5136
Instruction ID: b435d199805b71d04b19b9ff1d0c433f92d7a4571b6dc6ae0eb2abbcf6d6dc69
Opcode Fuzzy Hash: 0fc2a62b29909a6a0d3f044a1fbc6a2b647256b24c01ebaaa7850baca27c5136
Instruction Fuzzy Hash: 97328D63A0C6A291FE159B29D8743B92691AF44F80F444432DA5DC32D6EF2EED74C31B

Function 00007FF6E57A5C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6E57A5C45

Part of subcall function 00007FF6E57A5598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A55AC

Part of subcall function 00007FF6E579A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6E57A2D22,?,?,?,00007FF6E57A2D5F,?,?,00000000,00007FF6E57A3225,?,?,?,00007FF6E57A3157), ref: 00007FF6E579A95E
Part of subcall function 00007FF6E579A948: GetLastError.KERNEL32(?,?,?,00007FF6E57A2D22,?,?,?,00007FF6E57A2D5F,?,?,00000000,00007FF6E57A3225,?,?,?,00007FF6E57A3157), ref: 00007FF6E579A968

Part of subcall function 00007FF6E579A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6E579A8DF,?,?,?,?,?,00007FF6E579A7CA), ref: 00007FF6E579A909
Part of subcall function 00007FF6E579A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6E579A8DF,?,?,?,?,?,00007FF6E579A7CA), ref: 00007FF6E579A92E

_get_daylight.LIBCMT ref: 00007FF6E57A5C34

Part of subcall function 00007FF6E57A55F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A560C

_get_daylight.LIBCMT ref: 00007FF6E57A5EAA
_get_daylight.LIBCMT ref: 00007FF6E57A5EBB
_get_daylight.LIBCMT ref: 00007FF6E57A5ECC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6E57A610C), ref: 00007FF6E57A5EF3

Strings

Eastern Standard Time, xrefs: 00007FF6E57A5F99
Eastern Summer Time, xrefs: 00007FF6E57A5FB1

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: c118ce2a8ef8e7d9d17c36e227fffd060ce9bc1b8e9abf7ffc6b151aee1da0d2
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: 42D1D023A1825286EF20DF26D4607B96761EF84F84F408135EA4DC7696DF3EEC71874A

Function 00007FF6E57A6964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E57A6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A66D9
Part of subcall function 00007FF6E57A6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A6757
Part of subcall function 00007FF6E57A6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A67A8

CreateFileW.KERNELBASE ref: 00007FF6E57A6A6A
CreateFileW.KERNEL32 ref: 00007FF6E57A6ABA
GetLastError.KERNEL32 ref: 00007FF6E57A6AEA
GetFileType.KERNELBASE ref: 00007FF6E57A6AFF
GetLastError.KERNEL32 ref: 00007FF6E57A6B09
CloseHandle.KERNEL32 ref: 00007FF6E57A6B3C
CloseHandle.KERNEL32 ref: 00007FF6E57A6C9F
CreateFileW.KERNEL32 ref: 00007FF6E57A6CD4
GetLastError.KERNEL32 ref: 00007FF6E57A6CE3

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: 4421cbd6fdc199937788354ee72bdcb638e34ef7e7338ff810c55c5a40e0f66a
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: D3C19F37B28A4185EF10CF69C4A06AC3761F749B98B114229DA1EDB795DF3AD871C305

Function 00007FF6E57A5E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6E57A5EAA

Part of subcall function 00007FF6E57A55F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A560C

_get_daylight.LIBCMT ref: 00007FF6E57A5EBB

Part of subcall function 00007FF6E57A5598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A55AC

_get_daylight.LIBCMT ref: 00007FF6E57A5ECC

Part of subcall function 00007FF6E57A55C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A55DC

Part of subcall function 00007FF6E579A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6E57A2D22,?,?,?,00007FF6E57A2D5F,?,?,00000000,00007FF6E57A3225,?,?,?,00007FF6E57A3157), ref: 00007FF6E579A95E
Part of subcall function 00007FF6E579A948: GetLastError.KERNEL32(?,?,?,00007FF6E57A2D22,?,?,?,00007FF6E57A2D5F,?,?,00000000,00007FF6E57A3225,?,?,?,00007FF6E57A3157), ref: 00007FF6E579A968

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6E57A610C), ref: 00007FF6E57A5EF3

Strings

Eastern Standard Time, xrefs: 00007FF6E57A5F99
Eastern Summer Time, xrefs: 00007FF6E57A5FB1

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: d374f54cd3cfacab65e70d981fe8af7843d4636db7126c3a90c2eb967bd8906b
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: 8151C133A1864286EF50DF26D8A16B96761FB48F84F404135EA4EC7696DF3EEC308749

Function 00007FF6E5789280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF6E57892B3
FindClose.KERNELBASE ref: 00007FF6E57892C2

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 630b7f02b40f1aa7360b7bdcb0121614811b3296479f4d059f18ce3c57669cb9
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: C2F0C823A1874186FFA08B60F4A876A7750EB84B64F040335DA6DC2AD5DF3DD878CB09

Function 00007FF6E57A08C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction ID: da58365c79dd32e451036a7999cfd3a3de54230283602c596abfb930af2450c3
Opcode Fuzzy Hash: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction Fuzzy Hash: 9102AF23A1E65341FE65AB1194383792690AF45FA0F454A34DD9DDA3D3DE3EEC30831A

Function 00007FF6E5781950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E5787F90: _fread_nolock.LIBCMT ref: 00007FF6E578803A

_fread_nolock.LIBCMT ref: 00007FF6E5781A1B

Part of subcall function 00007FF6E5782910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6E5781B6A), ref: 00007FF6E578295E

Strings

calloc, xrefs: 00007FF6E5781A68
fread, xrefs: 00007FF6E5781A32, 00007FF6E5781B5C
malloc, xrefs: 00007FF6E5781B22
Could not read full TOC!, xrefs: 00007FF6E5781B55
Error on file., xrefs: 00007FF6E5781B8D
Failed to seek to cookie position!, xrefs: 00007FF6E57819EE
fseek, xrefs: 00007FF6E57819F5
Could not allocate memory for archive structure!, xrefs: 00007FF6E5781A61
Failed to read cookie!, xrefs: 00007FF6E5781A2B
MEI, xrefs: 00007FF6E5781991
Could not allocate buffer for TOC!, xrefs: 00007FF6E5781B1B

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 5da9196b77292879a3d34eab4b69eed09277f5a680287c42466cc399433b52bb
Instruction ID: 4c53e56441b76c422e068cc02e0c32acbb3628e2dc84878d151be5534d65095b
Opcode Fuzzy Hash: 5da9196b77292879a3d34eab4b69eed09277f5a680287c42466cc399433b52bb
Instruction Fuzzy Hash: 4A819173A086D286EF20DB24D0643B927A1AF84F84F444431D98DC7786DE3EE9B5875B

Function 00007FF6E5781600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6E57816DA
fread, xrefs: 00007FF6E57817E6
Failed to create symbolic link %s!, xrefs: 00007FF6E5781622
malloc, xrefs: 00007FF6E5781749
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6E57817DF
Failed to extract %s: failed to open target file!, xrefs: 00007FF6E578165C
fopen, xrefs: 00007FF6E5781663
fseek, xrefs: 00007FF6E57816E1
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6E57817CA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6E5781742
fwrite, xrefs: 00007FF6E57817D1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6E57816A2

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 5d93e2d9b492ec2590e9e2ead86152251fe080dd2e5e8658fb94e6c4b93608a5
Instruction ID: ed489929fd07267c006cd7f3a78dcf19dcb739462bea45f3667dbb91c0028f78
Opcode Fuzzy Hash: 5d93e2d9b492ec2590e9e2ead86152251fe080dd2e5e8658fb94e6c4b93608a5
Instruction Fuzzy Hash: 7D51A163B0869386EE109B1194203B923A1BF44F94F444535EE4CC7796DE3EED75874B

Function 00007FF6E5788660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF6E5783CBB), ref: 00007FF6E5788704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF6E5783CBB), ref: 00007FF6E578870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF6E5783CBB), ref: 00007FF6E578874C

Part of subcall function 00007FF6E5788830: GetEnvironmentVariableW.KERNEL32(00007FF6E578388E), ref: 00007FF6E5788867
Part of subcall function 00007FF6E5788830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6E5788889

Part of subcall function 00007FF6E5798238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5798251

Part of subcall function 00007FF6E5782810: MessageBoxW.USER32 ref: 00007FF6E57828EA

Strings

TMP, xrefs: 00007FF6E578869C, 00007FF6E57887A3
LOADER: failed to set the TMP environment variable., xrefs: 00007FF6E57886DC
_MEI%d, xrefs: 00007FF6E5788712
TMP, xrefs: 00007FF6E57886C2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF6E578877E

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction ID: c5e7d7fab5099ff724d3d04d004b6a871e49a0abaccd353147181ba27320bca2
Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction Fuzzy Hash: E2419213A19A5244FE10A76598753BA12A1AF44FC4F840531ED0DD77DADE3EED35830B

Function 00007FF6E5781210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6E57812BA
malloc, xrefs: 00007FF6E57812C1, 00007FF6E57812F6
1.3.1, xrefs: 00007FF6E5781249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6E5781276
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6E578141E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6E57812EF

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
Instruction ID: 04cb32d66c15de951b6a7770d9b094148f0a76274542a0abc184ab17383fac48
Opcode Fuzzy Hash: 8f2f3123d1cabff2ad8e3db6a95d4b235f7cad2490955ba460222a7cf36d71df
Instruction Fuzzy Hash: 8A51F423A0869285EE609B11A4603BA6291FF85F94F444131ED4DC7BD6EE3EEC71C70B

Function 00007FF6E57836B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6E5783804), ref: 00007FF6E57836E1
GetLastError.KERNEL32(?,00007FF6E5783804), ref: 00007FF6E57836EB

Part of subcall function 00007FF6E5782C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E5783706,?,00007FF6E5783804), ref: 00007FF6E5782C9E
Part of subcall function 00007FF6E5782C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E5783706,?,00007FF6E5783804), ref: 00007FF6E5782D63
Part of subcall function 00007FF6E5782C50: MessageBoxW.USER32 ref: 00007FF6E5782D99

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF6E5783739
Failed to obtain executable path., xrefs: 00007FF6E57836F3
\\?\, xrefs: 00007FF6E578375A
GetModuleFileNameW, xrefs: 00007FF6E57836FA
Failed to convert executable path to UTF-8., xrefs: 00007FF6E5783790

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: 5b0fec96b832982856d0075ac314ea0618ec70d315b532f091164405fb2f4e42
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 9F21B753B1895291FE209725EC703B62254BF44B94F800131EA5EC65D6EE2EED34C30B

Function 00007FF6E579BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E579BE89

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction ID: b3bb25ea907e6c21243a0528ec2b95cf3cf68bb4d61e4bd289e7f6af573058a9
Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction Fuzzy Hash: 52C1E12390C68681EE609B1590643BD2FA5FB81F80F574135EA4DC3391CE7EEC75872A

Function 00007FF6E5788570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6E5788590
OpenProcessToken.ADVAPI32 ref: 00007FF6E57885A3
GetTokenInformation.KERNELBASE ref: 00007FF6E57885C8
GetLastError.KERNEL32 ref: 00007FF6E57885D2
GetTokenInformation.KERNELBASE ref: 00007FF6E5788612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6E578862E
CloseHandle.KERNEL32 ref: 00007FF6E5788646

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction ID: 0f466b5249eff80fc79c7372932068c087beb5a2213f29358f83fd644e38898c
Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction Fuzzy Hash: A7216132B0C64342EE108B55F46432AA7A0FB81BE0F500635EA6DC3AD5DE7ED8758706

Function 00007FF6E57890E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E5788570: GetCurrentProcess.KERNEL32 ref: 00007FF6E5788590
Part of subcall function 00007FF6E5788570: OpenProcessToken.ADVAPI32 ref: 00007FF6E57885A3
Part of subcall function 00007FF6E5788570: GetTokenInformation.KERNELBASE ref: 00007FF6E57885C8
Part of subcall function 00007FF6E5788570: GetLastError.KERNEL32 ref: 00007FF6E57885D2
Part of subcall function 00007FF6E5788570: GetTokenInformation.KERNELBASE ref: 00007FF6E5788612
Part of subcall function 00007FF6E5788570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6E578862E
Part of subcall function 00007FF6E5788570: CloseHandle.KERNEL32 ref: 00007FF6E5788646

LocalFree.KERNEL32(?,00007FF6E5783C55), ref: 00007FF6E578916C
LocalFree.KERNEL32(?,00007FF6E5783C55), ref: 00007FF6E5789175

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6E5789142
S-1-3-4, xrefs: 00007FF6E5789121
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6E5789183
D:(A;;FA;;;%s), xrefs: 00007FF6E5789157

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: 2413bc399c2d9a785e978e640a2b030781804cf77a55d75237ff3e1ba43094c1
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: 69217122A1875281FF10AB10E4253EA62A5FF84B80F444031EA4DD3B86DF3EED748746

Function 00007FF6E5787E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF6E578352C,?,00000000,00007FF6E5783F23), ref: 00007FF6E5787F32

Strings

\, xrefs: 00007FF6E5787E97
%s%c, xrefs: 00007FF6E5787EA4
%.*s, xrefs: 00007FF6E5787EEB

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 9023beffec3a57a4629e8abb22503f1b718fcdb28fa34784c50d465fb9ddbb72
Instruction ID: 4547f53f39be3a1e8b606d0701facd39e8c327a06f772773d4d2234f0ceae348
Opcode Fuzzy Hash: 9023beffec3a57a4629e8abb22503f1b718fcdb28fa34784c50d465fb9ddbb72
Instruction Fuzzy Hash: 0C310A62619AD145EE218B11E4207AA6354EF84FE0F400230EE6EC7BC9DF3DDA268706

Function 00007FF6E579CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E579CF4B), ref: 00007FF6E579D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E579CF4B), ref: 00007FF6E579D107

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: f20d892eed983c1f67c20a2ce3397d816488759b1691224f14b68e6369da925b
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 6B91E233E1865185FF618F6584603BE2BA0AB44F88F564139DE0ED7684CF3AD872C326

Function 00007FF6E579F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6E579FA7C
_get_daylight.LIBCMT ref: 00007FF6E579FA8D
_get_daylight.LIBCMT ref: 00007FF6E579FA9E
_isindst.LIBCMT ref: 00007FF6E579FB69

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 6ab7218769b3e96ed6fa9859bc1c4609510dceb3081737046a3292afa635161f
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 3151D273F042128AEF14CF7899757BC27A1AB44B68F510235DD1ED2AE5DE39E822C605

Function 00007FF6E579577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6E57957AF
GetFileInformationByHandle.KERNELBASE ref: 00007FF6E5795811
GetLastError.KERNEL32 ref: 00007FF6E57958A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E57956B4), ref: 00007FF6E57958EE

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: 490672eac482fe2128502cb2b0767a3de1a7335d6201e5434ed67d97cd5d8745
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: 64517A23E186518AFB10CF7194607BD27A1AF48B98F164434DE0DCAA89DF39D8B08766

Function 00007FF6E5795628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5795655
CreateFileW.KERNELBASE ref: 00007FF6E5795694
CloseHandle.KERNEL32 ref: 00007FF6E57956C9

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction ID: 33974b73b0be635f95206d5451cbbd7df3dd0451dbb791a2882e1bf961cfc4d3
Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction Fuzzy Hash: F8418123D2879283EB508F20D5603696760FF94BA4F119335EA9C83AD2DF7DA9F08715

Function 00007FF6E578CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E578CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6E578CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6E578CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF6E578CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6E578CD21

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 05bb0bea18d81b239c05cb3fb1e89d83595bb84ce170ea995cf784114a5e6fce
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 52313923E0826681FE54BB6594723B91685AF45F84F455034DA0DCB2D3DE2FBC34831B

Function 00007FF6E579013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5790180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5790277

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: f85e69355c849c9989385d362b28a38bc26b9a0b59948c9a8f2d23a9d9d73d35
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 30511823B2924186EF64DA25942077E6691BF44FA4F1A4634DD7DC37C5CE3EEC30862A

Function 00007FF6E579C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF6E579C2CD), ref: 00007FF6E579C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF6E579C2CD), ref: 00007FF6E579C18A

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 8a6036abc1f661d46dbcb156fcaf58e24f8aeed5622670d911bcfa3c3512a2bd
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 8811EF62618A8181DE208B25A820269A361AB85FF0F540331EE7DCB7E9CE3DD8308709

Function 00007FF6E5795924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E5795839), ref: 00007FF6E5795957
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E5795839), ref: 00007FF6E579596D

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction ID: 0208fb4fdd5114c7d44a7b0fc042aab30ab06bfc6f477ccb81ca632c1c4ff0a2
Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction Fuzzy Hash: 3E118F2261C62282EE548B15A42123AB760EF84BB1F600236FA9DC19D8EF6DD834DF15

Function 00007FF6E579A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF6E57A2D22,?,?,?,00007FF6E57A2D5F,?,?,00000000,00007FF6E57A3225,?,?,?,00007FF6E57A3157), ref: 00007FF6E579A95E
GetLastError.KERNEL32(?,?,?,00007FF6E57A2D22,?,?,?,00007FF6E57A2D5F,?,?,00000000,00007FF6E57A3225,?,?,?,00007FF6E57A3157), ref: 00007FF6E579A968

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: af8636155d83063fa96acebfd331eb34c7374926268c7e5245cf2c397fe6e875
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: B0E08652F0A24343FF145BF194793391651BF88F40F460034C80DC6292DE2DACB1832A

Function 00007FF6E579AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF6E579A9D5,?,?,00000000,00007FF6E579AA8A), ref: 00007FF6E579ABC6
GetLastError.KERNEL32(?,?,?,00007FF6E579A9D5,?,?,00000000,00007FF6E579AA8A), ref: 00007FF6E579ABD0

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 637fb9be61b830893466d697cf975e9d54107538ca6ae010dfcf86c2584f4804
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 99210813F0D68201FEA0979594B037D16929F84F90F0A0238D96EC77C2CE6EEC70431A

Function 00007FF6E579BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E579BED4

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 109b2fe229f27420485463cbf3ab81e80e8ae027e2a6e44ba56847c0641b628b
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 4041D27391D24187EE248A19A4603797BA1EB55F80F150135EA8EC37D1CF2EE832CB66

Function 00007FF6E5787F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6E578803A

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 7026eb3b68f3585a2f5768ea15c5ca7bda34a28a3ae4cdbb6486ed2f903c9d01
Instruction ID: 3c6d1715586e31ef05ec306b2075db5ac3a7ed67785771f5256eddfa68256070
Opcode Fuzzy Hash: 7026eb3b68f3585a2f5768ea15c5ca7bda34a28a3ae4cdbb6486ed2f903c9d01
Instruction Fuzzy Hash: 7821AD13B1866245FE509A1269247B95651BF45FC4F8D4430DE0DCB746CE7EE871C70B

Function 00007FF6E579B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E579B9C2

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: 80c83dd5f771e20f7c1f56a3950d876b93bda5459f22742e76a842be4c018733
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: 7F318F23A2C64281EA116B55946537C2AA1BF80FA0F430135E95DC73D2CE7EACB1872B

Function 00007FF6E5795F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5795EF9

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 5759d6a29f0dd222a70ae74b56062fd9afea943b1e1c602e80b8f7332003ff42
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 31118363A2965241EE609F1194203796261BF85F80F460035EA8CD7A95CF3EDC70472A

Function 00007FF6E57A6354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A6377

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 3481a6859c8c55bc28b88c3e318470f0a9f07f8030ce9607f1846aa2784fefae
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: D321B073A1CA4286DF619F28D45037976A0BB84F54F244234EA5EC76DADF3ED8318B05

Function 00007FF6E57903BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5790410

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 4a5a880bdeb80a001d695a690e5773d9721348df64cd1ae73c63d6951491f422
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: E90108A2A2874140EE40DF525910269A7A1BF92FE0F4A4230EE5CD3BE6CE3ED8318315

Function 00007FF6E5797EFC Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5797F3A

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction ID: bafcf74e78801fc11a9af9e7eca4a2fd9442a7989d612b1d9cd868d860a215d3
Opcode Fuzzy Hash: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction Fuzzy Hash: 8101C063E1D68340FE606B2155213791292AF46FD0F464235EA5CEA7C6DF2EAC73422B

Function 00007FF6E5798238 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5798251

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: d4c4a1693501cd8cd8abb8bf2c7c982cec75600a6e3237514e5971e60d4f4223
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: A4E0C2A3E1DA0387FF153AA404A27B812315F95B40F470135E908C62C3DD3E6CB4923B

Function 00007FF6E579EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF6E579B32A,?,?,?,00007FF6E5794F11,?,?,?,?,00007FF6E579A48A), ref: 00007FF6E579EBED

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: b31f43df099b7dbc8a4fbc744251f356d560a3b9b8e0022932a0ac8fc6e93a43
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: 2AF06D56B0920340FE5866A69875BB413919F89FC0F4E8530CD0FC63C2EE1EECB4423A

Function 00007FF6E579D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6E5790C90,?,?,?,00007FF6E57922FA,?,?,?,?,?,00007FF6E5793AE9), ref: 00007FF6E579D63A

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 13e1013eeecf3b1ba1c3488490e1c63855af920ad1c0616257256ae496332831
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: DFF03A16A0928240FE565AB1586577612915F88FE0F0A0630DD2EC62C2DE2EACB0812A

Non-executed Functions

Function 00007FF6E57876C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6E57876D7
GetLastError.KERNEL32 ref: 00007FF6E57876E9
GetProcAddress.KERNEL32 ref: 00007FF6E5787725
GetLastError.KERNEL32 ref: 00007FF6E5787737
GetProcAddress.KERNEL32 ref: 00007FF6E5787750
GetLastError.KERNEL32 ref: 00007FF6E5787762
GetProcAddress.KERNEL32 ref: 00007FF6E578777B
GetLastError.KERNEL32 ref: 00007FF6E578778D
GetProcAddress.KERNEL32 ref: 00007FF6E57877A9
GetLastError.KERNEL32 ref: 00007FF6E57877BB
GetProcAddress.KERNEL32 ref: 00007FF6E57877D7
GetLastError.KERNEL32 ref: 00007FF6E57877E9
GetProcAddress.KERNEL32 ref: 00007FF6E5787805
GetLastError.KERNEL32 ref: 00007FF6E5787817
GetProcAddress.KERNEL32 ref: 00007FF6E5787833
GetLastError.KERNEL32 ref: 00007FF6E5787845
GetProcAddress.KERNEL32 ref: 00007FF6E5787861
GetLastError.KERNEL32 ref: 00007FF6E5787873

Strings

GetProcAddress, xrefs: 00007FF6E57876FF
Tcl_CreateThread, xrefs: 00007FF6E5787829, 00007FF6E578784B
Tcl_MutexUnlock, xrefs: 00007FF6E57878E1, 00007FF6E5787903
Tcl_GetString, xrefs: 00007FF6E5787AAD, 00007FF6E5787ACF
Tcl_NewStringObj, xrefs: 00007FF6E5787ADB, 00007FF6E5787AFD
Tcl_EvalEx, xrefs: 00007FF6E5787BC1, 00007FF6E5787BE3
Tcl_ThreadQueueEvent, xrefs: 00007FF6E57879C7, 00007FF6E57879E9
Tcl_CreateObjCommand, xrefs: 00007FF6E5787A7F, 00007FF6E5787AA1
Tcl_DoOneEvent, xrefs: 00007FF6E5787771, 00007FF6E5787793
Tcl_MutexLock, xrefs: 00007FF6E57878B3, 00007FF6E57878D5
Tcl_ConditionWait, xrefs: 00007FF6E5787999, 00007FF6E57879BB
Tcl_FindExecutable, xrefs: 00007FF6E5787746, 00007FF6E5787768
Tcl_Alloc, xrefs: 00007FF6E5787C1D, 00007FF6E5787C3F
Tcl_SetVar2, xrefs: 00007FF6E5787A51, 00007FF6E5787A73
Tcl_SetVar2Ex, xrefs: 00007FF6E5787B37, 00007FF6E5787B59
Tcl_Init, xrefs: 00007FF6E57876D0, 00007FF6E57876EF
Tcl_GetObjResult, xrefs: 00007FF6E5787B65, 00007FF6E5787B87
Tcl_MutexFinalize, xrefs: 00007FF6E578790F, 00007FF6E5787931
Tcl_DeleteInterp, xrefs: 00007FF6E57877FB, 00007FF6E578781D
Tcl_EvalObjv, xrefs: 00007FF6E5787BEF, 00007FF6E5787C11
Tcl_GetCurrentThread, xrefs: 00007FF6E5787857, 00007FF6E5787879
Tk_GetNumMainWindows, xrefs: 00007FF6E5787CA7, 00007FF6E5787CC9
Tcl_GetVar2, xrefs: 00007FF6E5787A23, 00007FF6E5787A45
Failed to get address for %hs, xrefs: 00007FF6E57876F8
Tcl_ThreadAlert, xrefs: 00007FF6E57879F5, 00007FF6E5787A17
Tcl_Finalize, xrefs: 00007FF6E578779F, 00007FF6E57877C1
Tcl_FinalizeThread, xrefs: 00007FF6E57877CD, 00007FF6E57877EF
Tcl_JoinThread, xrefs: 00007FF6E5787885, 00007FF6E57878A7
Tk_Init, xrefs: 00007FF6E5787C79, 00007FF6E5787C9B
Tcl_ConditionNotify, xrefs: 00007FF6E578796B, 00007FF6E578798D
Tcl_EvalFile, xrefs: 00007FF6E5787B93, 00007FF6E5787BB5
Tcl_Free, xrefs: 00007FF6E5787C4B, 00007FF6E5787C6D
Tcl_ConditionFinalize, xrefs: 00007FF6E578793D, 00007FF6E578795F
Tcl_CreateInterp, xrefs: 00007FF6E578771B, 00007FF6E578773D
Tcl_NewByteArrayObj, xrefs: 00007FF6E5787B09, 00007FF6E5787B2B

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: 1fd8c12c35b1aabbab91b9384c4135a6ca567065e82196ea09300166c20390e3
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 8502BA63A0AB07D0EE159B65A8747B62761AF05F85F441031D82EC6261EF3FFD79820B

Function 00007FF6E57A40AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6E57A40FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A4766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A48DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A4B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A4DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A4FF7
memcpy_s.LIBCPMT ref: 00007FF6E57A50D2
memcpy_s.LIBCPMT ref: 00007FF6E57A517D
memcpy_s.LIBCPMT ref: 00007FF6E57A524C

Strings

1#IND, xrefs: 00007FF6E57A41E7
1#INF, xrefs: 00007FF6E57A4223
1#QNAN, xrefs: 00007FF6E57A4213
1#SNAN, xrefs: 00007FF6E57A420A

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction ID: c48511761969aea5920cae9593d80866df4e1dfc8885b7efc8febc8e9ef9f533
Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction Fuzzy Hash: 02B2E573A182828BEB648E24D4607FD37A2FB54B48F501135DA09D7A86DF3AED70CB45

Function 00007FF6E57883C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF6E5788919,00007FF6E5783FA5), ref: 00007FF6E578842B
RemoveDirectoryW.KERNEL32(?,00007FF6E5788919,00007FF6E5783FA5), ref: 00007FF6E57884AE
DeleteFileW.KERNEL32(?,00007FF6E5788919,00007FF6E5783FA5), ref: 00007FF6E57884CD
FindNextFileW.KERNEL32(?,00007FF6E5788919,00007FF6E5783FA5), ref: 00007FF6E57884DB
FindClose.KERNEL32(?,00007FF6E5788919,00007FF6E5783FA5), ref: 00007FF6E57884EC
RemoveDirectoryW.KERNEL32(?,00007FF6E5788919,00007FF6E5783FA5), ref: 00007FF6E57884F5

Strings

%s\*, xrefs: 00007FF6E57883F2

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: 917195e34f35823cf048b6e5b5b08161955a815588de5a40666b3a554bee364c
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: 22418223A1C55281EE609F60E4683BA63A0FB94F94F500632DA5DC2785EF3EDD798707

Function 00007FF6E578ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid code lengths set, xrefs: 00007FF6E578AE2D
invalid distances set, xrefs: 00007FF6E578B1A0
invalid distance too far back, xrefs: 00007FF6E578B670
too many length or distance symbols, xrefs: 00007FF6E578AE46
invalid bit length repeat, xrefs: 00007FF6E578B099
invalid literal/lengths set, xrefs: 00007FF6E578B133
invalid literal/length code, xrefs: 00007FF6E578B3E2
invalid distance code, xrefs: 00007FF6E578B5B4
invalid code -- missing end-of-block, xrefs: 00007FF6E578B0C6

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
Instruction ID: 1ea31a5ad965a4811cf144f50bda299d0ac83f3c161c8c811946ae866ac61e0e
Opcode Fuzzy Hash: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
Instruction Fuzzy Hash: 3452D373A186B54BDBA48F14C468B7D3BA9EB44740F054139E68AC7780DF3ADC64CB46

Function 00007FF6E578D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6E578D148
RtlCaptureContext.KERNEL32 ref: 00007FF6E578D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6E578D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF6E578D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF6E578D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6E578D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6E578D24C

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: 7ade973e75ee0b381894fe49ac4c8b60bd490b28c9cedb2ae95519a25d81ec35
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: DA314F73609B8186EB608F60E8907EE7760FB84B44F04403ADA4E87B95EF3DD968C715

Function 00007FF6E579A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6E579A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6E579A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6E579A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF6E579A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6E579A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6E579A72E

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: 457fc43f9b857628b2294d3c2b08fe32f8b137cf69a34ee5ecf2579d3873217d
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 04318E37608B8186DB60CF24E8507AE37A4FB88B94F500136EA8DC3B95EF3DC5658B01

Function 00007FF6E57A1874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A18C0
FindFirstFileExW.KERNEL32 ref: 00007FF6E57A19CA

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: 34c07ba9357330d2066b321d4a1dfe0368dd27d5724a728157b60a8559f376f2
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: 44B1F623B1969241FE609B2194243B96391EB44FE0F445531EA5DC7B8AEF3DEC71C306

Function 00007FF6E578D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6E578D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF6E578D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF6E578D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF6E578D066

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: d5d5924efaac2697eb16b666c954108250a1a4a83440119eea9ecdb449b11a29
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: C5111C22B14B058AEF409B60E8643A933B4FB59B98F440E31DA6DC67A4EF78D5748345

Function 00007FF6E57A3C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6E57A3C76
memcpy_s.LIBCPMT ref: 00007FF6E57A3CA1

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 9abb3739fb485b057cb0442df0cd2f5f61d4fcf7169457a8d0bdb06624b36758
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 7BC1C173B1868687EB248F19A05476AB7A1F788B84F448135DB4AC3785DF3EEC61CB44

Function 00007FF6E578A474 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00007FF6E578A921
unknown header flags set, xrefs: 00007FF6E578A4C5
, xrefs: 00007FF6E578A55B

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
Instruction ID: 61f941425e1c7a06ec46cc9dd587ab27c37c1f82902ef1b95c10765229b8ad6b
Opcode Fuzzy Hash: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
Instruction Fuzzy Hash: 02F19373A083E58BEBA58F158098B3A3AA9EF44B50F054538DA89C7790CF3DDD61C746

Function 00007FF6E57A9728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6E57A9977
RaiseException.KERNEL32 ref: 00007FF6E57A9988

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction ID: 78165e56fe7d14710eba97bbf505d3102378a508d7b60825d5500c4657b5783f
Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction Fuzzy Hash: 3FB13B73A04B898AEB15CF29C8563687BA0F784F48F158922DA5DC37A5CF3AD871C705

Function 00007FF6E57939A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6E5793B12
, xrefs: 00007FF6E5793D54

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: e254bb4a89fd4bcead030ae0e4f42718910124ef65942bdb03bc26224bf0cbc6
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: 29E17F33A0865685EF688E2D806023923A1FB45F48F265235DE1EC7694DF2BEC71C75A

Function 00007FF6E578A2DB Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF6E578A45B
invalid window size, xrefs: 00007FF6E578A442

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
Instruction ID: 444ac7a88a5226234178a568ff7d7e4b0446cc37de53bd63bbb90029a94e52d9
Opcode Fuzzy Hash: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
Instruction Fuzzy Hash: 84918773A1829687EBA48E14C46CB3E3A99FB44750F114139DA9EC6790CF39ED60CB47

Function 00007FF6E579DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF6E579E07A
e+000, xrefs: 00007FF6E579DFFD

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: 2917d72393d9fe29a5a7ea6ee53d6037aa0f731e3e338ff95a26b9f780979662
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: 54517C63B182C146EB258E39982176A6792F744F94F49C231CBACC7BC5CE3ED860C716

Function 00007FF6E579DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6E579DD9E

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 229a10ea05873c6a3dae52e4375eb655abf6f321f536e78d5f89fda34bfdf4b4
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: CAA15863A087C946EF22CF25A4207AA7B91EB51F84F068032DE4DC7785DE3ED821C716

Function 00007FF6E5798794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF6E57987B3

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction ID: eef3996ecab03d678a5114d4a35f937cee8e88cb95a27a0bbe3698bf542c09c5
Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction Fuzzy Hash: 5C51E303F1961341FE64AA2759347BA52A16F40FE4F4A4435DE0EC7786EE3EEC31422A

Function 00007FF6E57A3480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6E57A3484

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: ffdf64c462c12ec37490dad1800842a10a8832e9d3f0a574b1b583388b58bd21
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: 94B09221E07A02C2EE086B21AC92B1826A4BF48B01F980139C40DC4330EF2D28F55706

Function 00007FF6E57935A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction ID: 385b1002bfc3f2e657e47c1427a24f46511aade78f43f1313fea65f0d4a6fa92
Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction Fuzzy Hash: 8CD1C367A0864286EF688E2D806477D27A1AB05F48F160235CE0DC7795CF3BEC75C76A

Function 00007FF6E5789800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction ID: 13067a5741c6d71e6e657a012f71341de570ed0caca1e12e3be3385c9e2a8b6a
Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction Fuzzy Hash: 8CC18E772181E08BD289EB29E47947A73D1F78930DB95406BEF8787785CA3CA824DB11

Function 00007FF6E5792C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: 79c7e865811a7c94a6604f698774333149f3bf53dbe9488be97d7b6eb593acd8
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: 35B16D7390869585EB64DF29C0A427C3BA0E749F48F264139CA4EC7395CF3AD871C76A

Function 00007FF6E579E570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: f8a41b2b6dc7b1edee8ed584dd865cb669337de32eeea9c8ccf65602f951185f
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: A281F373A0878146EB74CF19946037A6B91FB45BD0F058235DE8DC3B89DE3EE8208B16

Function 00007FF6E57A6418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
Instruction ID: 23535e7991c935823eeb6a6d89d0b196bf99294a76a1e381ff3206b0296798d3
Opcode Fuzzy Hash: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
Instruction Fuzzy Hash: B961C423E1C25246FF648A39946477D6691AF81F60F190239D61EC36C6DF6FEC30870A

Function 00007FF6E5791D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: cd0b2d17a24eccce2d958b97ddbc8596b923f21c8ec9a65c389ad49fe131a2d4
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: B8518F77A18A6582EB248B29C06436833A1EB85F68F264135CA4DC7794CF3BEC72C755

Function 00007FF6E5791944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 24511970b2a1330b68462283cdf4b29fc4a7b317c1bdc5a9230c366e0af9aafb
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: B9515F37A1865286EB248B29C06433827A1EB45F68F264131CA8DD7794DF3BEC73C756

Function 00007FF6E5792164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 7cd4a3a5dd33947a3eb444998958deca7e04919f7f8459be51cf9ad9313cab8f
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: B3519037A2865182EB249B29C46072C63A1EB59F68F264131CA4CC7794CF3BEC73C755

Function 00007FF6E5791740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 1fdf5c234a024344726c191edb1c69849a544f72a72d70ccd9a81f6e6001fcd8
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 19519C3BA1865286EB248B29C06477827A1EB45F68F264131CE4CD7794CF3BEC72C795

Function 00007FF6E5791F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 2613599db301a9fb0ea03ecaa54bf127b0fccc37649c7731052fe6bf1efef407
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 86519D77A2965582EB248B29C06033827A1EB44F58F264131CA4DD77A9CF3BEC73C795

Function 00007FF6E5791B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: 3ad264f37db1a575239967a43d9d38048f0b9cb90dfb9263e3dfa1e8ec920528
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 67519F37A18A5186EB248B29C06032827A1EB85F58F265131CE4CD7794DF3BEC73C799

Function 00007FF6E5795D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: b0810ec3d95cc74996d54a738a2088d1f396ff680a7bcb01e660e65ff806eef2
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: EC41E66382D77A05EDA9891845287B416809FA3FA0D5A13B8CD9DDB3C7CC0F6DB6C126

Function 00007FF6E5799EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction ID: 13542f5c75d66c4cda6e4d573140f3e93de57512fc9dfe3395e430a39256c37f
Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction Fuzzy Hash: 83412973715A5582EF44CF2AD924269B3A2F748FD0B099432DE4DD7B58DE3EC8618305

Function 00007FF6E57980E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: a40cec628f00b46f686a4701ac55693cea34b117ee49d68ce123aa5cc8251cbd
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: 44311433719B4281EB649F21A45022D66E5AB84FE0F05423CEA8DD3BD6CF3DD8318709

Function 00007FF6E57A9570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: cad7787283d9c7355a59f5ec5d64effd09a385da67b1123f66fdf66482464e14
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: A2F04472B182958ADB98DF6DB45262977D0F748780F408139D58DC7A04DF3DD4718F09

Function 00007FF6E578D30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: 66bf2c769588193a8f702a84362211233abc25dbd91a0a149e5309220efdb4ea
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: 0BA0012290C91AD0EA448B00A8B0A662620FB58B41B800032E00DD14A1AF2EA834920B

Function 00007FF6E5785830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E5785840
GetLastError.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E5785852
GetProcAddress.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E5785889
GetLastError.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E578589B
GetProcAddress.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E57858B4
GetLastError.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E57858C6
GetProcAddress.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E57858DF
GetLastError.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E57858F1
GetProcAddress.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E578590D
GetLastError.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E578591F
GetProcAddress.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E578593B
GetLastError.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E578594D
GetProcAddress.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E5785969
GetLastError.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E578597B
GetProcAddress.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E5785997
GetLastError.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E57859A9
GetProcAddress.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E57859C5
GetLastError.KERNEL32(?,00007FF6E57864CF,?,00007FF6E578336E), ref: 00007FF6E57859D7

Strings

PyErr_Clear, xrefs: 00007FF6E5785AA1, 00007FF6E5785AC3
PyImport_ImportModule, xrefs: 00007FF6E5785C3F, 00007FF6E5785C61
GetProcAddress, xrefs: 00007FF6E5785868
PyConfig_SetWideStringList, xrefs: 00007FF6E5785A73, 00007FF6E5785A95
PyConfig_Clear, xrefs: 00007FF6E578598D, 00007FF6E57859AF
PyErr_Print, xrefs: 00007FF6E5785B59, 00007FF6E5785B7B
Py_DecRef, xrefs: 00007FF6E5785836, 00007FF6E5785858
PyEval_EvalCode, xrefs: 00007FF6E5785BB5, 00007FF6E5785BD7
PyObject_SetAttrString, xrefs: 00007FF6E5785D81, 00007FF6E5785DA3
PyErr_Restore, xrefs: 00007FF6E5785B87, 00007FF6E5785BA9
PyModule_GetDict, xrefs: 00007FF6E5785CC9, 00007FF6E5785CEB
Py_PreInitialize, xrefs: 00007FF6E578595F, 00007FF6E5785981
PyConfig_Read, xrefs: 00007FF6E57859E9, 00007FF6E5785A0B
Py_DecodeLocale, xrefs: 00007FF6E578587F, 00007FF6E57858A1
PyObject_GetAttrString, xrefs: 00007FF6E5785D53, 00007FF6E5785D75
PyConfig_InitIsolatedConfig, xrefs: 00007FF6E57859BB, 00007FF6E57859DD
PyUnicode_DecodeFSDefault, xrefs: 00007FF6E5785F1F, 00007FF6E5785F41
PyErr_Occurred, xrefs: 00007FF6E5785B2B, 00007FF6E5785B4D
PyUnicode_Replace, xrefs: 00007FF6E5785FD7, 00007FF6E5785FF9
PyStatus_Exception, xrefs: 00007FF6E5785E39, 00007FF6E5785E5B
PyConfig_SetBytesString, xrefs: 00007FF6E5785A17, 00007FF6E5785A39
PyUnicode_AsUTF8, xrefs: 00007FF6E5785EC3, 00007FF6E5785EE5
PyMarshal_ReadObjectFromString, xrefs: 00007FF6E5785C6D, 00007FF6E5785C8F
PyErr_NormalizeException, xrefs: 00007FF6E5785AFD, 00007FF6E5785B1F
PyObject_CallFunctionObjArgs, xrefs: 00007FF6E5785D25, 00007FF6E5785D47
PyMem_RawFree, xrefs: 00007FF6E5785C9B, 00007FF6E5785CBD
Py_IsInitialized, xrefs: 00007FF6E5785931, 00007FF6E5785953
Py_Finalize, xrefs: 00007FF6E57858D5, 00007FF6E57858F7
Failed to get address for %hs, xrefs: 00007FF6E5785861
Py_InitializeFromConfig, xrefs: 00007FF6E5785903, 00007FF6E5785925
PyImport_ExecCodeModule, xrefs: 00007FF6E5785C11, 00007FF6E5785C33
PyUnicode_Decode, xrefs: 00007FF6E5785EF1, 00007FF6E5785F13
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6E5785DDD, 00007FF6E5785DFF
PyUnicode_FromString, xrefs: 00007FF6E5785F7B, 00007FF6E5785F9D
PyObject_CallFunction, xrefs: 00007FF6E5785CF7, 00007FF6E5785D19
Py_ExitStatusException, xrefs: 00007FF6E57858AA, 00007FF6E57858CC
PyConfig_SetString, xrefs: 00007FF6E5785A45, 00007FF6E5785A67
PyErr_Fetch, xrefs: 00007FF6E5785ACF, 00007FF6E5785AF1
PyRun_SimpleStringFlags, xrefs: 00007FF6E5785E0B, 00007FF6E5785E2D
PySys_SetObject, xrefs: 00007FF6E5785E95, 00007FF6E5785EB7
PyImport_AddModule, xrefs: 00007FF6E5785BE3, 00007FF6E5785C05
PyUnicode_FromFormat, xrefs: 00007FF6E5785F4D, 00007FF6E5785F6F
PyUnicode_Join, xrefs: 00007FF6E5785FA9, 00007FF6E5785FCB
PySys_GetObject, xrefs: 00007FF6E5785E67, 00007FF6E5785E89
PyObject_Str, xrefs: 00007FF6E5785DAF, 00007FF6E5785DD1

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 0eb536be5c6fb7670d1c343824abd8e30479c1422c347d2f07ea7660cb2ad681
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: AD22B563A1AB17A1FE059B65A87477527A4AF08F81F441035D51EC6262FF3EFC78820B

Function 00007FF6E57881D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E5789390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E57845F4,00000000,00007FF6E5781985), ref: 00007FF6E57893C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF6E57886B7,?,?,00000000,00007FF6E5783CBB), ref: 00007FF6E578822C

Part of subcall function 00007FF6E5782810: MessageBoxW.USER32 ref: 00007FF6E57828EA

Strings

LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF6E578829D
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6E57882D9
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6E5788240
%.*s, xrefs: 00007FF6E578830C
\, xrefs: 00007FF6E5788261
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF6E5788373
CreateDirectory, xrefs: 00007FF6E578837C
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6E5788203

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction ID: 7c273fc23be7b64a93fff05bf0e04f3efc9a3f7076d5108782c236ad935b7ff0
Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction Fuzzy Hash: 6D519613A2C65281FE509B25E8717BE6390AF94F80F444831D60EC26D6EE3EEC35834B

Function 00007FF6E5782180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6E57821AB
SelectObject.GDI32 ref: 00007FF6E57821F2
DrawTextW.USER32 ref: 00007FF6E5782215
SelectObject.GDI32 ref: 00007FF6E578222B
ReleaseDC.USER32 ref: 00007FF6E578223B
MoveWindow.USER32 ref: 00007FF6E578228B
MoveWindow.USER32 ref: 00007FF6E57822CB
MoveWindow.USER32 ref: 00007FF6E578231E
MoveWindow.USER32 ref: 00007FF6E5782366

Strings

P%, xrefs: 00007FF6E57821FF

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: ad2e5a093597b465d80fb1689ad37a8c154d6ea147635f3d9d6f0d08be26ad41
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 275128266047A186DA349F32E4282BABBA1F798BA1F004121EFCEC3795DF3CD455CB14

Function 00007FF6E57880C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF6E57880FF
GetWindowLongPtrW.USER32 ref: 00007FF6E578817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF6E5788192
GetLastError.KERNEL32 ref: 00007FF6E578819C
SetWindowLongPtrW.USER32 ref: 00007FF6E57881B3

Strings

Needs to remove its temporary files., xrefs: 00007FF6E5788185

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 90ec326bacb2500e486985bbc67f3b722222abd3c9c097550ec0f3e8ee3239a8
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 08217623B19A4282EF458B7AE8643796650EF84FD0F584135DA1DC33D5DE2DDDB18207

Function 00007FF6E5796290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57962D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57966C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E579695C

Strings

p, xrefs: 00007FF6E57963FD
-, xrefs: 00007FF6E5796369
f, xrefs: 00007FF6E57963F5
p, xrefs: 00007FF6E5796385
:, xrefs: 00007FF6E579648C

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: cdd25f54b7254392055f99d7d0591dfab9d63dcd7620c8ec55865b7f42e2216e
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 65128067E0C28386FF245E14D1647B97662EB40F50F864235D689C66C4DF3EEDB08B2A

Function 00007FF6E5790FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5791008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57913D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E579166F

Strings

p, xrefs: 00007FF6E5791112
f, xrefs: 00007FF6E5791255
f, xrefs: 00007FF6E57910A0
p, xrefs: 00007FF6E57910AD
f, xrefs: 00007FF6E579110A

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 627d684ee7d89e5d15682760e93a274dc3f58dda26eedc13b01259002e6a1b5e
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 91128563E1C54386FF209E15D06477976A1FB40B90F964031D69AC6AC4DF3EEDB08B2A

Function 00007FF6E5781050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6E57810CC
fread, xrefs: 00007FF6E57811FD
malloc, xrefs: 00007FF6E578110F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6E57811F6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6E5781108
fseek, xrefs: 00007FF6E57810D3
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6E5781098

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: ff5b4fad13ef8aaee9d991072cb01505e6ede49a985447baf4eec0a072074c38
Instruction ID: c9671914a869813a0f302ee47f88aa6cba666aea87625d67f348e13525db22ba
Opcode Fuzzy Hash: ff5b4fad13ef8aaee9d991072cb01505e6ede49a985447baf4eec0a072074c38
Instruction Fuzzy Hash: B2419063B186A286EE10DB12A8247B96791BF44FC4F444432ED0CC7786DE3EE975874B

Function 00007FF6E5781470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6E57814DE
fread, xrefs: 00007FF6E57815E6
malloc, xrefs: 00007FF6E578151F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6E57815DF
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6E5781518
fseek, xrefs: 00007FF6E57814E5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6E578149F

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 1a2ba8a856b3fca217ae97ea7c4189b5fa745fbbe5bd2f21962a353e35730f78
Instruction ID: fa39254ce2afc7f5f1275155fe194beac0db39c091bc86833a5bf56acfbd87cd
Opcode Fuzzy Hash: 1a2ba8a856b3fca217ae97ea7c4189b5fa745fbbe5bd2f21962a353e35730f78
Instruction Fuzzy Hash: 16418E23B0869286EE10DB2294207B96391BF44F94F444932ED1DC7B96DE3EED75870B

Function 00007FF6E578EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6E578EA65

Part of subcall function 00007FF6E578F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6E578F9FF
Part of subcall function 00007FF6E578F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6E578FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6E578EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6E578ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6E578EE98

Strings

csm, xrefs: 00007FF6E578EB60
csm, xrefs: 00007FF6E578EAE6
csm, xrefs: 00007FF6E578EA7F

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 84b7582ea644eeeaa68bf1b84b3f351ce31c4c7f0266842168ef179d64256e27
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 81D18D23A0876186EF209B2594603ADA7A0FB45B98F140135EE4DD7B96CF39E8B4C707

Function 00007FF6E579ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6E579F0AA,?,?,00000232227169D8,00007FF6E579AD53,?,?,?,00007FF6E579AC4A,?,?,?,00007FF6E5795F3E), ref: 00007FF6E579EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF6E579F0AA,?,?,00000232227169D8,00007FF6E579AD53,?,?,?,00007FF6E579AC4A,?,?,?,00007FF6E5795F3E), ref: 00007FF6E579EE98

Strings

api-ms-, xrefs: 00007FF6E579EDD6
ext-ms-, xrefs: 00007FF6E579EDE9

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: ad40d3aa4f05644a62cb90849aafb0183dab027b0cc212c565fc3f0aeecd1ac7
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 9C41BF63B19A1241FE159B16982077523A1BF48FD0F8A8139DD1DC7384EE3EEC75831A

Function 00007FF6E5782C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E5783706,?,00007FF6E5783804), ref: 00007FF6E5782C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E5783706,?,00007FF6E5783804), ref: 00007FF6E5782D63
MessageBoxW.USER32 ref: 00007FF6E5782D99

Strings

Error, xrefs: 00007FF6E5782D8C
[PYI-%d:ERROR] , xrefs: 00007FF6E5782CA6
<FormatMessageW failed.>, xrefs: 00007FF6E5782D70
%ls: , xrefs: 00007FF6E5782D22

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: d144595578db3afed06f82bc915917d6ca8bcdeb4ff2aebcf8d76ee7d280866d
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 5331E723708A5142EA20AB25B8247AA6A95BF84FC9F410135EF4DD3759DF3DD936C305

Function 00007FF6E578DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6E578DF7A,?,?,?,00007FF6E578DC6C,?,?,?,00007FF6E578D869), ref: 00007FF6E578DD4D
GetLastError.KERNEL32(?,?,?,00007FF6E578DF7A,?,?,?,00007FF6E578DC6C,?,?,?,00007FF6E578D869), ref: 00007FF6E578DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6E578DF7A,?,?,?,00007FF6E578DC6C,?,?,?,00007FF6E578D869), ref: 00007FF6E578DD85
FreeLibrary.KERNEL32(?,?,?,00007FF6E578DF7A,?,?,?,00007FF6E578DC6C,?,?,?,00007FF6E578D869), ref: 00007FF6E578DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF6E578DF7A,?,?,?,00007FF6E578DC6C,?,?,?,00007FF6E578D869), ref: 00007FF6E578DDFF

Strings

api-ms-, xrefs: 00007FF6E578DD6D

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 1c59b13dfa60c98a0dac66d3fa964065c5b857d3c9e39c6e8d5b2172b1e1a212
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 3F31D263B1A72291EE119B1294207B62794FF48FA0F590536DD1DC7384EF3EE874832A

Function 00007FF6E5786360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

LoadLibrary, xrefs: 00007FF6E57864AE
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF6E5786456
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF6E57863C7
ucrtbase.dll, xrefs: 00007FF6E57863DD
Failed to load Python DLL '%ls'., xrefs: 00007FF6E57864A7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF6E5786407

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: bd35b640c02035bc0e077a05b147b005ab0e639f37cafda848bc65a29b3ec2f1
Instruction ID: b1b471b0bde8407fdf8a3984a7dbc7e0e2b9f790d63925557c86df373d90959b
Opcode Fuzzy Hash: bd35b640c02035bc0e077a05b147b005ab0e639f37cafda848bc65a29b3ec2f1
Instruction Fuzzy Hash: 0E419423A1C696A1EE10DB10E4243E96355FF54B44F800132EA5DC7696EF3DEA35C347

Function 00007FF6E5782A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6E578351A,?,00000000,00007FF6E5783F23), ref: 00007FF6E5782AA0

Strings

Warning, xrefs: 00007FF6E5782B1E
[PYI-%d:%s] , xrefs: 00007FF6E5782AA8
Warning [ANSI Fallback], xrefs: 00007FF6E5782B0F
WARNING, xrefs: 00007FF6E5782AAF
0, xrefs: 00007FF6E5782B16

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: a51e602b0fed659afacd74dc0d6961e8ee51360b2dce04a78f3db09dcce3c690
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 5821A133A1878192EB209B51B8607E667A4FB88BC4F400132FE8DC3759DF3DDA658745

Function 00007FF6E579B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6E579B15F
FlsGetValue.KERNEL32 ref: 00007FF6E579B174
FlsSetValue.KERNEL32 ref: 00007FF6E579B195
FlsSetValue.KERNEL32 ref: 00007FF6E579B1C2
FlsSetValue.KERNEL32 ref: 00007FF6E579B1D3
FlsSetValue.KERNEL32 ref: 00007FF6E579B1E4
SetLastError.KERNEL32 ref: 00007FF6E579B1FF

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction ID: ba2db286dc09dfe3bf73bd60bef0b0be4b685de3b3cbfdb2c193ae2f7cb052d8
Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction Fuzzy Hash: 90216D22B1D64241FE596325597533956425F44FF0F128734D92EC66CADD2EEC30832B

Function 00007FF6E57A7D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6E57A7D9D
GetLastError.KERNEL32 ref: 00007FF6E57A7DA9
CloseHandle.KERNEL32 ref: 00007FF6E57A7DC1
CreateFileW.KERNEL32 ref: 00007FF6E57A7DEC
WriteConsoleW.KERNEL32 ref: 00007FF6E57A7E0B

Strings

CONOUT$, xrefs: 00007FF6E57A7DCD

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: de4b917fe6f339dd1c941239fd3815c5ac8f78f9844dc294055c5752783a45b4
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: E2119322B18A4186EB909B12E86432967A0FB88FE4F000234EE5DC7795DF3DDC348749

Function 00007FF6E5788ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF6E5783FB1), ref: 00007FF6E5788EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF6E5783FB1), ref: 00007FF6E5788F5A

Part of subcall function 00007FF6E5789390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E57845F4,00000000,00007FF6E5781985), ref: 00007FF6E57893C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6E5783FB1), ref: 00007FF6E5788FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6E5783FB1), ref: 00007FF6E5789044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6E5783FB1), ref: 00007FF6E5789055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6E5783FB1), ref: 00007FF6E578906A

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction ID: be5ad65963963244afbf1026d90232c85b5c699ae74af92e1587a4012549fe19
Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction Fuzzy Hash: 76416E63A1969281EE209B12A5203BA6794EB85FC4F450135EF4DD7789DE3ED930C70A

Function 00007FF6E579B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6E5794F11,?,?,?,?,00007FF6E579A48A,?,?,?,?,00007FF6E579718F), ref: 00007FF6E579B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF6E5794F11,?,?,?,?,00007FF6E579A48A,?,?,?,?,00007FF6E579718F), ref: 00007FF6E579B30D
FlsSetValue.KERNEL32(?,?,?,00007FF6E5794F11,?,?,?,?,00007FF6E579A48A,?,?,?,?,00007FF6E579718F), ref: 00007FF6E579B33A
FlsSetValue.KERNEL32(?,?,?,00007FF6E5794F11,?,?,?,?,00007FF6E579A48A,?,?,?,?,00007FF6E579718F), ref: 00007FF6E579B34B
FlsSetValue.KERNEL32(?,?,?,00007FF6E5794F11,?,?,?,?,00007FF6E579A48A,?,?,?,?,00007FF6E579718F), ref: 00007FF6E579B35C
SetLastError.KERNEL32(?,?,?,00007FF6E5794F11,?,?,?,?,00007FF6E579A48A,?,?,?,?,00007FF6E579718F), ref: 00007FF6E579B377

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction ID: 65d675e59f14fd81c10ad915383c753f2cc112214364b0b1a314546a98985b42
Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction Fuzzy Hash: DF116D22B0D64282FE55A325567133D26869F44FF0F168734D82EC67D6DE2EEC31832A

Function 00007FF6E5782910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6E5781B6A), ref: 00007FF6E578295E

Strings

Error, xrefs: 00007FF6E5782A0E
Error [ANSI Fallback], xrefs: 00007FF6E57829FF
%s: %s, xrefs: 00007FF6E57829E8
[PYI-%d:ERROR] , xrefs: 00007FF6E5782966

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: b6ad30916c1c09036fecc657025e79cdaadcdf1385189c935b25d4cec9cd7fd3
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: 0331F423B1869152EB20A761B8607E66695BF88BD4F400132FE8DC3759EF3DD9768306

Function 00007FF6E5782390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6E57823C8
DialogBoxIndirectParamW.USER32 ref: 00007FF6E578248E
DeleteObject.GDI32 ref: 00007FF6E57824C1
DestroyIcon.USER32 ref: 00007FF6E57824D3

Strings

Unhandled exception in script, xrefs: 00007FF6E57823F8

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction ID: 9bbc910bb3d1893117586434706996873ed36f314dccd4758535cf193209942a
Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction Fuzzy Hash: F1318073619A8285EF20DB21E8643FA6760FF88B88F440135EA4DC7B5ADF3DD5248706

Function 00007FF6E5782B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF6E578918F,?,00007FF6E5783C55), ref: 00007FF6E5782BA0
MessageBoxW.USER32 ref: 00007FF6E5782C2A

Strings

Warning, xrefs: 00007FF6E5782C1D
WARNING, xrefs: 00007FF6E5782BAF
[PYI-%d:%ls] , xrefs: 00007FF6E5782BA8

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: f35cb244d64ab6d82a8b2cbd7543f4f77c618e092206ded9c6043b0000eb4bb1
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 2A21D163708B8182EB109B24F8547AA77A4FB88BC0F400136EE8DD775ADE3DDA25C745

Function 00007FF6E5782710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6E5781B99), ref: 00007FF6E5782760

Strings

ERROR, xrefs: 00007FF6E578276F
Error, xrefs: 00007FF6E57827DE
Error [ANSI Fallback], xrefs: 00007FF6E57827CF
[PYI-%d:%s] , xrefs: 00007FF6E5782768

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: ffbc39600ceb5bbe68ca27f8b149ea86339ad2f092baacd38b6be3b02d5c451b
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: 8821D133A18B9182EB209B11B8507E6A7A4FB88BC0F400131FE8CC3749DF3DD9658745

Function 00007FF6E5799A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6E5799AAD
GetProcAddress.KERNEL32 ref: 00007FF6E5799AC3
FreeLibrary.KERNEL32 ref: 00007FF6E5799AEA

Strings

mscoree.dll, xrefs: 00007FF6E5799AA4
CorExitProcess, xrefs: 00007FF6E5799ABC

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: bd75b4d076dc116b53c3211d7ccd3280d5bb514a4804b4d71fc91acdb117c96c
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: ADF06223B1970681FE108B64E4A537A6720EF49FA1F540235D66EC65E4DF2EDCB4C31A

Function 00007FF6E57A9368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6E57A9390
_set_statfp.LIBCMT ref: 00007FF6E57A93AB
_set_statfp.LIBCMT ref: 00007FF6E57A93C7
_set_statfp.LIBCMT ref: 00007FF6E57A9403

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: a3e1d1b9a652b730e6b57e875b7796daac127c9fdcdf270a0ed2a243d7fc0c72
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: CC118223E5CA0301FF641165E4F13792060AF59F60E040635FB6EDA2DB9E6EEC71810A

Function 00007FF6E579B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6E579A5A3,?,?,00000000,00007FF6E579A83E,?,?,?,?,?,00007FF6E579A7CA), ref: 00007FF6E579B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF6E579A5A3,?,?,00000000,00007FF6E579A83E,?,?,?,?,?,00007FF6E579A7CA), ref: 00007FF6E579B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF6E579A5A3,?,?,00000000,00007FF6E579A83E,?,?,?,?,?,00007FF6E579A7CA), ref: 00007FF6E579B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF6E579A5A3,?,?,00000000,00007FF6E579A83E,?,?,?,?,?,00007FF6E579A7CA), ref: 00007FF6E579B407
FlsSetValue.KERNEL32(?,?,?,00007FF6E579A5A3,?,?,00000000,00007FF6E579A83E,?,?,?,?,?,00007FF6E579A7CA), ref: 00007FF6E579B418

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction ID: f7e9a4bb1b1f18792edfe0d9c45e18f6faea575928e660161ccae31dae3f1841
Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction Fuzzy Hash: BD116062F0D60241FE55A325567133926425F44FF0F5A8334E82DC67DADD2EEC31822A

Function 00007FF6E579B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6E579B235
FlsSetValue.KERNEL32 ref: 00007FF6E579B254
FlsSetValue.KERNEL32 ref: 00007FF6E579B27C
FlsSetValue.KERNEL32 ref: 00007FF6E579B28D
FlsSetValue.KERNEL32 ref: 00007FF6E579B29E

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction ID: 716ca7516366e61c7ac4fb80c1ef0d65246f3e962df9b1fa28d61dc8226bc492
Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction Fuzzy Hash: 6B110622A0D60741FD9962654471B7D56828F45F70F168734D93ECA6C6DD2FBC70822B

Function 00007FF6E5795FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5795FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5796106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57961BC

Strings

verbose, xrefs: 00007FF6E5795FB0

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 105d98a9b9cada3433750b43fa6fa2644b852c02208633d649ae36831048acb1
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 0F91BF23A1CA4681EF218F24D460B7D76A1AB40F94F464232DA59C73D5DE3EEC75832A

Function 00007FF6E579FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E579FEA7

Part of subcall function 00007FF6E5797A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5797A59

Strings

ccs, xrefs: 00007FF6E579FDE2
UTF-8, xrefs: 00007FF6E579FE26
UTF-16LEUNICODE, xrefs: 00007FF6E579FE45

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: fe7301bd9aa671460b062bb5dc7fb83100d77263d828986336cc4c395feb766e
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: EE819F73E0825285FF669E29817037826A0AB51F48F579035CA09D7289CF2FED71D36B

Function 00007FF6E578D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6E578D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6E578D70A
RtlUnwindEx.KERNEL32 ref: 00007FF6E578D764

Strings

csm, xrefs: 00007FF6E578D6F1

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 981e62f79452afe0563c438b1f4c50fd95358dafb7552c778112b778bc6642e0
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: D3518E23A19B128ADF149B15E064B7A6791EB44F98F108130DA4EC7748EF7EEC71C74A

Function 00007FF6E578EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6E578EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6E578EF83

Strings

RCC, xrefs: 00007FF6E578EF53
MOC, xrefs: 00007FF6E578EF4B

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: 62175ba05c0ccc111bdddb31ac4b9286972fb3c935d8ace2e3633004421cf0ae
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 9161B233908BC585DB609B15E4503AAB7A0FB85B94F044225EB9C83B95DF7DE4B0CB06

Function 00007FF6E578F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6E578F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6E578F398

Strings

csm, xrefs: 00007FF6E578F3EA
csm, xrefs: 00007FF6E578F2D2

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: b16ff50deb6f994177598dfc8f809631333dc78970d77ad1df299056def558d3
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: 65516D73A0866286EF648A21D06476877A0EB55F94F144136DA4DC7B96CF3EEC70C70B

Function 00007FF6E5782810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF6E57828EA

Strings

Error, xrefs: 00007FF6E57828DD
[PYI-%d:%ls] , xrefs: 00007FF6E5782868
ERROR, xrefs: 00007FF6E578286F

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 0208d4da63006592725eb6886bdd13e200a84246229bb93df0bf58e3918dfe55
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: E021B163708B8182EB109B14B4547AA67A4FB88B80F400135EA8DD7656DE3DDA65C745

Function 00007FF6E579C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6E579C61F
WriteFile.KERNEL32 ref: 00007FF6E579C8E7
WriteFile.KERNEL32 ref: 00007FF6E579C92D
GetLastError.KERNEL32 ref: 00007FF6E579C9E3

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: abb66cd675b9ed6405c304be12af731a48422914498159d289ca425a6d837926
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 1DD1F173B08A818AEF10CF65D4542AC37B5FB14B98B414226DF4ED7B89DE39D826C319

Function 00007FF6E57820C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6E57820F4
SetWindowLongPtrW.USER32 ref: 00007FF6E5782116
GetWindowLongPtrW.USER32 ref: 00007FF6E5782140
InvalidateRect.USER32 ref: 00007FF6E5782160

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 5a81a760aef9423e534de8653270569283c46cea8fe4f5f03d24f1cd4b4ba83e
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 6911C622E1C15242FE548769E59437D5691EB84FC1F548030DA49C7B8ACD3EECB5820B

Function 00007FF6E57A5B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E57A1760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A1793

_get_daylight.LIBCMT ref: 00007FF6E57A5C34
_get_daylight.LIBCMT ref: 00007FF6E57A5C45

Strings

?, xrefs: 00007FF6E57A5BC5

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: b55d68124ba815418bae25daf9f65b02e98933a54820d35a8aaeaaf022abbf1f
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: EC414913A2828245FF648B26942137A6751EB81FA4F144235EE5CC6ADBDF3ED871870A

Function 00007FF6E5799014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5799046

Part of subcall function 00007FF6E579A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6E57A2D22,?,?,?,00007FF6E57A2D5F,?,?,00000000,00007FF6E57A3225,?,?,?,00007FF6E57A3157), ref: 00007FF6E579A95E
Part of subcall function 00007FF6E579A948: GetLastError.KERNEL32(?,?,?,00007FF6E57A2D22,?,?,?,00007FF6E57A2D5F,?,?,00000000,00007FF6E57A3225,?,?,?,00007FF6E57A3157), ref: 00007FF6E579A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6E578CBA5), ref: 00007FF6E5799064

Strings

C:\Users\user\Desktop\UpdaterTool.exe, xrefs: 00007FF6E5799052

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\UpdaterTool.exe
API String ID: 3580290477-643795526
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: c4b67e8724eac1670034c3749c3349838c419f1888f3d29122cabdb15ea10865
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: FE417D33A08A1285EF149F2594602BD67A5FB48BD0B564035EA4DC7B85DF3ADCB1831A

Function 00007FF6E579CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6E579CD4F
GetLastError.KERNEL32 ref: 00007FF6E579CD71

Strings

U, xrefs: 00007FF6E579CCFB

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: 8a2197c304c05daf9c48c42a983564b20b75f268c701daebb25effcbbc2eb3df
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: 9441CF23A18A4182DF208F25E4553AA6BA4FB88B84F814131EF4DC7B88EF3DD821C755

Function 00007FF6E579F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6E579F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6E579F64A

Strings

:, xrefs: 00007FF6E579F60E

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction ID: 2363369884e3030a066018fd0c1c1dc5342fa3f99462f1603be180c7b92e6aed
Opcode Fuzzy Hash: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction Fuzzy Hash: B821C063A1838181EF219F15906436E63B1FB84F84F464035DA8DC3684CF7EDD64C756

Function 00007FF6E578FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6E578FD98
RaiseException.KERNEL32 ref: 00007FF6E578FDD9

Strings

csm, xrefs: 00007FF6E578FDC6

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: b5b4a9ba682ca322d3b1bae934d86309418faadcc05e20a6c4e2ea2fbc9837e4
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: E4114C33618B9182EB218F25E4102597BE4FB88B84F584231DB8D87755DF3DD971C705

Function 00007FF6E57A073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A076C
GetDriveTypeW.KERNEL32 ref: 00007FF6E57A07AC

Strings

:, xrefs: 00007FF6E57A0795

Memory Dump Source

Source File: 00000000.00000002.2939611241.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000000.00000002.2939576663.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939737847.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939808858.00007FF6E57C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2939922579.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 162db22d88843129e40d7267b953b2f5e5b91da29128e6b3796b1a4b328c16d2
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 2601846391820386FF61AF60947937E23A0EF44B44F950435D64DC6686EE3ED9748F1E

Analysis Process: UpdaterTool.exePID: 7456, Parent PID: 7432COMMON

Executed Functions

Function 00007FFDFABD8A30 Relevance: 591.1, APIs: 57, Strings: 280, Instructions: 1345
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PySys_GetObject.PYTHON313 ref: 00007FFDFABD8A5A
PyLong_AsUnsignedLongMask.PYTHON313 ref: 00007FFDFABD8A68
PyErr_Occurred.PYTHON313 ref: 00007FFDFABD8A75
PyErr_Clear.PYTHON313 ref: 00007FFDFABD8AA1
?PyWinGlobals_Ensure@@YAHXZ.PYWINTYPES313 ref: 00007FFDFABD8ABE
PyModule_Create2.PYTHON313 ref: 00007FFDFABD8AD5
PyModule_GetDict.PYTHON313 ref: 00007FFDFABD8AE6
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABD8B0E
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABD8B25
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABD8B3C
PyType_Ready.PYTHON313 ref: 00007FFDFABD8B4C
PyType_Ready.PYTHON313 ref: 00007FFDFABD8B65
PyType_Ready.PYTHON313 ref: 00007FFDFABD8B7E
PyType_Ready.PYTHON313 ref: 00007FFDFABD8B97
_Py_NewReference.PYTHON313 ref: 00007FFDFABD8BBA
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABD8BD4
_Py_NewReference.PYTHON313 ref: 00007FFDFABD8BEE
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABD8C08
_Py_NewReference.PYTHON313 ref: 00007FFDFABD8C22
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABD8C3C
_Py_NewReference.PYTHON313 ref: 00007FFDFABD8C56
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABD8C70
PyErr_SetString.PYTHON313 ref: 00007FFDFABD8C96
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABD8CAE
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABD8CC9
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABD8CEB
PyErr_NewException.PYTHON313 ref: 00007FFDFABD8D05
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABD8D1F
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABD8D48
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABD8D63
_Py_Dealloc.PYTHON313 ref: 00007FFDFABD8D79
PyType_Ready.PYTHON313 ref: 00007FFDFABD8D93
PyType_Ready.PYTHON313 ref: 00007FFDFABD8DA9
PyType_Ready.PYTHON313 ref: 00007FFDFABD8DBF
PyType_Ready.PYTHON313 ref: 00007FFDFABD8DD5
PyType_Ready.PYTHON313 ref: 00007FFDFABD8DEB
PyModule_Create2.PYTHON313 ref: 00007FFDFABD8E06
PyDict_New.PYTHON313 ref: 00007FFDFABD8E18
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABD8E32
GetModuleHandleW.KERNEL32 ref: 00007FFDFABD8E3F
GetProcAddress.KERNEL32 ref: 00007FFDFABD8E57
GetProcAddress.KERNEL32 ref: 00007FFDFABD8E6E
GetProcAddress.KERNEL32 ref: 00007FFDFABD8E85
GetProcAddress.KERNEL32 ref: 00007FFDFABD8E9C
GetProcAddress.KERNEL32 ref: 00007FFDFABD8EB3
GetModuleHandleW.KERNEL32 ref: 00007FFDFABD8EC7
LoadLibraryExW.KERNEL32 ref: 00007FFDFABD8ED9

Part of subcall function 00007FFDFABD89C0: PyLong_FromLong.PYTHON313 ref: 00007FFDFABD89D8

Part of subcall function 00007FFDFABD89C0: PyDict_SetItemString.PYTHON313 ref: 00007FFDFABD8A02
Part of subcall function 00007FFDFABD89C0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABD8A18

Part of subcall function 00007FFDFABD12D0: GetModuleHandleW.KERNEL32 ref: 00007FFDFABD12E6
Part of subcall function 00007FFDFABD12D0: GetProcAddress.KERNEL32 ref: 00007FFDFABD12FB

GetProcAddress.KERNEL32 ref: 00007FFDFABD8EEE
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABDA3FB
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABDA411
_Py_Dealloc.PYTHON313 ref: 00007FFDFABDA425
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABDA432
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABDA448
_Py_Dealloc.PYTHON313 ref: 00007FFDFABDA45C
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABDA469
PyDict_SetItemString.PYTHON313 ref: 00007FFDFABDA47F
_Py_Dealloc.PYTHON313 ref: 00007FFDFABDA493

Strings

STDOLE_LCID, xrefs: 00007FFDFABD9A20
VT_FILETIME, xrefs: 00007FFDFABD9F78
TypeIIDs, xrefs: 00007FFDFABD8B04
VT_VARIANT, xrefs: 00007FFDFABD9DD4
RPC_C_AUTHN_DEC_PUBLIC, xrefs: 00007FFDFABD97B6
TYPEFLAG_FAPPOBJECT, xrefs: 00007FFDFABD9AAA
REGCLS_SUSPENDED, xrefs: 00007FFDFABD9645
VT_R8, xrefs: 00007FFDFABD9D41
ACTIVEOBJECT_STRONG, xrefs: 00007FFDFABD8EFE
FUNCFLAG_FDEFAULTBIND, xrefs: 00007FFDFABD930F
RPC_C_AUTHZ_NONE, xrefs: 00007FFDFABD9870
MSHLFLAGS_TABLEWEAK, xrefs: 00007FFDFABDA155
TYPEFLAG_FREVERSEBIND, xrefs: 00007FFDFABD9BBB
TYMED_ISTREAM, xrefs: 00007FFDFABD9060
IDLFLAG_NONE, xrefs: 00007FFDFABD93F0
TKIND_ALIAS, xrefs: 00007FFDFABD9C4B
MSHCTX_NOSHAREDMEM, xrefs: 00007FFDFABDA0EF
INVOKE_PROPERTYPUT, xrefs: 00007FFDFABD95DF
EOAC_DYNAMIC, xrefs: 00007FFDFABD992A
fdexPropCanPutRef, xrefs: 00007FFDFABDA278
VT_INT, xrefs: 00007FFDFABD9E91
RPC_C_AUTHN_WINNT, xrefs: 00007FFDFABD97E0
MKSYS_FILEMONIKER, xrefs: 00007FFDFABD9480
TYPEFLAG_FDUAL, xrefs: 00007FFDFABD9B28
FUNC_VIRTUAL, xrefs: 00007FFDFABD934B
ServerInterfaces, xrefs: 00007FFDFABD8B1B
MSHLFLAGS_NORMAL, xrefs: 00007FFDFABDA12B
VT_BSTR, xrefs: 00007FFDFABD9D80
FUNC_DISPATCH, xrefs: 00007FFDFABD939F
DISPID_NEWENUM, xrefs: 00007FFDFABD91FE
EOAC_STATIC_CLOAKING, xrefs: 00007FFDFABD993F
RPC_C_IMP_LEVEL_DELEGATE, xrefs: 00007FFDFABD9765
fdexPropCannotPut, xrefs: 00007FFDFABDA263
FUNCFLAG_FHIDDEN, xrefs: 00007FFDFABD9324
DISPATCH_PROPERTYPUTREF, xrefs: 00007FFDFABD9159
VT_UI1, xrefs: 00007FFDFABD9E28
MKSYS_ANTIMONIKER, xrefs: 00007FFDFABD9495
STREAM_SEEK_END, xrefs: 00007FFDFABD95A0
FUNCFLAG_FSOURCE, xrefs: 00007FFDFABD92BB
ArgNotFound, xrefs: 00007FFDFABD8C32
INVOKE_PROPERTYPUTREF, xrefs: 00007FFDFABD95F4
VT_I2, xrefs: 00007FFDFABD9D02
VT_LPWSTR, xrefs: 00007FFDFABD9F4E
EXTCONN_CALLABLE, xrefs: 00007FFDFABD9291
TKIND_ENUM, xrefs: 00007FFDFABD9BCD
RPC_C_AUTHN_LEVEL_NONE, xrefs: 00007FFDFABD9696
TKIND_MODULE, xrefs: 00007FFDFABD9BF7
VT_BYREF, xrefs: 00007FFDFABDA074
CoGetCancelObject, xrefs: 00007FFDFABD8E74
DESCKIND_FUNCDESC, xrefs: 00007FFDFABDA34A
TYPEFLAG_FRESTRICTED, xrefs: 00007FFDFABD9B67
EOAC_ANY_AUTHORITY, xrefs: 00007FFDFABD9969
TYMED_GDI, xrefs: 00007FFDFABD908A
SYS_MAC, xrefs: 00007FFDFABD9A95
STDOLE_MAJORVERNUM, xrefs: 00007FFDFABD99FC
TYMED_ENHMF, xrefs: 00007FFDFABD90B4
DISPATCH_PROPERTYGET, xrefs: 00007FFDFABD912F
RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, xrefs: 00007FFDFABD96EA
TYPEFLAG_FCANCREATE, xrefs: 00007FFDFABD9ABF
MSHLFLAGS_NOPING, xrefs: 00007FFDFABDA16A
VT_RESERVED, xrefs: 00007FFDFABDA089
CreateURLMonikerEx, xrefs: 00007FFDFABD8EE4
fdexPropCanCall, xrefs: 00007FFDFABDA2CC
TYPEFLAG_FNONEXTENSIBLE, xrefs: 00007FFDFABD9B3D
CoCreateInstanceEx, xrefs: 00007FFDFABD8E8B
FUNC_STATIC, xrefs: 00007FFDFABD938A
VT_BOOL, xrefs: 00007FFDFABD9DBF
VT_TYPEMASK, xrefs: 00007FFDFABDA0C8
URL_MK_UNIFORM, xrefs: 00007FFDFABDA17F
RPC_C_IMP_LEVEL_IDENTIFY, xrefs: 00007FFDFABD973B
DATADIR_GET, xrefs: 00007FFDFABD900C
DISPID_EVALUATE, xrefs: 00007FFDFABD9213
FUNCFLAG_FREQUESTEDIT, xrefs: 00007FFDFABD92E5
TKIND_UNION, xrefs: 00007FFDFABD9C60
REGCLS_MULTIPLEUSE, xrefs: 00007FFDFABD961B
PARAMFLAG_FLCID, xrefs: 00007FFDFABD9525
DVASPECT_DOCPRINT, xrefs: 00007FFDFABD911A
VT_LPSTR, xrefs: 00007FFDFABD9F39
TYPEFLAG_FPREDECLID, xrefs: 00007FFDFABD9AE9
fdexNameImplicit, xrefs: 00007FFDFABDA1FA
RPC_C_AUTHN_GSS_SCHANNEL, xrefs: 00007FFDFABD97F5
RPC_C_AUTHN_DCE_PUBLIC, xrefs: 00007FFDFABD97A1
CLSCTX_INPROC, xrefs: 00007FFDFABD8F3D
fdexPropCanConstruct, xrefs: 00007FFDFABDA2F6
PARAMFLAG_FOPT, xrefs: 00007FFDFABD954F
DVASPECT_CONTENT, xrefs: 00007FFDFABD90DB
VARFLAG_FREADONLY, xrefs: 00007FFDFABD9C75
RPC_C_IMP_LEVEL_DEFAULT, xrefs: 00007FFDFABD9711
RPC_C_AUTHN_MQ, xrefs: 00007FFDFABD9849
urlmon.dll, xrefs: 00007FFDFABD8EC0, 00007FFDFABD8ED2
VT_I4, xrefs: 00007FFDFABD9D17
EOAC_DISABLE_AAA, xrefs: 00007FFDFABD99D2
VAR_DISPATCH, xrefs: 00007FFDFABD9CC6
IMPLTYPEFLAG_FSOURCE, xrefs: 00007FFDFABD93C9
FMTID_SummaryInformation, xrefs: 00007FFDFABDA438
DISPID_THIS, xrefs: 00007FFDFABD9252
STDOLE2_MINORVERNUM, xrefs: 00007FFDFABD9A47
VT_DECIMAL, xrefs: 00007FFDFABD9DFE
SYS_WIN16, xrefs: 00007FFDFABD9A6B
coinit_flags, xrefs: 00007FFDFABD8A4E
VT_RECORD, xrefs: 00007FFDFABD9F63
VT_VOID, xrefs: 00007FFDFABD9EBB
ROTFLAGS_ALLOWANYCLIENT, xrefs: 00007FFDFABD966F
VT_R4, xrefs: 00007FFDFABD9D2C
fdexNameEnsure, xrefs: 00007FFDFABDA1E5
CLSCTX_INPROC_SERVER, xrefs: 00007FFDFABD8F67
VT_SAFEARRAY, xrefs: 00007FFDFABD9EFA
MKSYS_POINTERMONIKER, xrefs: 00007FFDFABD94BF
RPC_C_AUTHZ_NAME, xrefs: 00007FFDFABD9885
fdexPropCannotCall, xrefs: 00007FFDFABDA2E1
EOAC_APPID, xrefs: 00007FFDFABD9915
RPC_C_AUTHN_LEVEL_DEFAULT, xrefs: 00007FFDFABD9681
fdexNameCaseSensitive, xrefs: 00007FFDFABDA1D0
DVASPECT_ICON, xrefs: 00007FFDFABD9105
can't define ole_error, xrefs: 00007FFDFABD8C8C
FMTID_UserDefinedProperties, xrefs: 00007FFDFABDA46F
EOAC_AUTO_IMPERSONATE, xrefs: 00007FFDFABD99A8
VT_BLOB, xrefs: 00007FFDFABD9F8D
dcom, xrefs: 00007FFDFABDA3E5
INVOKE_FUNC, xrefs: 00007FFDFABD95B5
IMPLTYPEFLAG_FRESTRICTED, xrefs: 00007FFDFABD93DE
TYPEFLAG_FREPLACEABLE, xrefs: 00007FFDFABD9B91
EOAC_MAKE_FULLSIC, xrefs: 00007FFDFABD997E
DISPID_UNKNOWN, xrefs: 00007FFDFABD91D4, 00007FFDFABD923D
VT_UI8, xrefs: 00007FFDFABD9E7C
IDLFLAG_FIN, xrefs: 00007FFDFABD9405
FUNCFLAG_FRESTRICTED, xrefs: 00007FFDFABD92A6
RPC_C_AUTHN_LEVEL_CALL, xrefs: 00007FFDFABD96C0
CLSCTX_REMOTE_SERVER, xrefs: 00007FFDFABD8FA6
TYPEFLAG_FDISPATCHABLE, xrefs: 00007FFDFABD9BA6
fdexPropCannotConstruct, xrefs: 00007FFDFABDA30B
VT_ILLEGAL, xrefs: 00007FFDFABDA09E
PARAMFLAG_FRETVAL, xrefs: 00007FFDFABD953A
MSHLFLAGS_TABLESTRONG, xrefs: 00007FFDFABDA140
MSHCTX_INPROC, xrefs: 00007FFDFABDA119
fdexPropCanGet, xrefs: 00007FFDFABDA224
MKSYS_GENERICCOMPOSITE, xrefs: 00007FFDFABD946B
STDOLE2_LCID, xrefs: 00007FFDFABD9A59
ole_error, xrefs: 00007FFDFABD8CA4
COINIT_SPEED_OVER_MEMORY, xrefs: 00007FFDFABD8FF7
VAR_PERINSTANCE, xrefs: 00007FFDFABD9C87
EOAC_REQUIRE_FULLSIC, xrefs: 00007FFDFABD9993
FUNCFLAG_FBINDABLE, xrefs: 00007FFDFABD92D0
MSHCTX_LOCAL, xrefs: 00007FFDFABDA0DA
frozen, xrefs: 00007FFDFABDA375
VT_USERDEFINED, xrefs: 00007FFDFABD9F24
VT_CARRAY, xrefs: 00007FFDFABD9F0F
VT_DISPATCH, xrefs: 00007FFDFABD9D95
STDOLE_MINORVERNUM, xrefs: 00007FFDFABD9A0E
STREAM_SEEK_CUR, xrefs: 00007FFDFABD958B
error, xrefs: 00007FFDFABD8CBF
FMTID_DocSummaryInformation, xrefs: 00007FFDFABDA401
CoWaitForMultipleHandles, xrefs: 00007FFDFABD8E4D
EOAC_DYNAMIC_CLOAKING, xrefs: 00007FFDFABD9954
EXTCONN_STRONG, xrefs: 00007FFDFABD9267
COINIT_MULTITHREADED, xrefs: 00007FFDFABD8FCD
VT_ILLEGALMASKED, xrefs: 00007FFDFABDA0B3
RPC_C_AUTHN_LEVEL_PKT, xrefs: 00007FFDFABD96D5
VT_PTR, xrefs: 00007FFDFABD9EE5
VT_I8, xrefs: 00007FFDFABD9E67
RPC_C_AUTHN_DCE_PRIVATE, xrefs: 00007FFDFABD978C
SYS_WIN32, xrefs: 00007FFDFABD9A80
CLSCTX_LOCAL_SERVER, xrefs: 00007FFDFABD8F91
Missing, xrefs: 00007FFDFABD8BFE
IDLFLAG_FRETVAL, xrefs: 00007FFDFABD9444
DATADIR_SET, xrefs: 00007FFDFABD9021
MKSYS_ITEMMONIKER, xrefs: 00007FFDFABD94AA
TYPEFLAG_FHIDDEN, xrefs: 00007FFDFABD9AFE
CLSCTX_INPROC_HANDLER, xrefs: 00007FFDFABD8F7C
TKIND_DISPATCH, xrefs: 00007FFDFABD9C21
TYPEFLAG_FCONTROL, xrefs: 00007FFDFABD9B13
IMPLTYPEFLAG_FDEFAULT, xrefs: 00007FFDFABD93B4
DISPID_COLLECT, xrefs: 00007FFDFABD91AD
REGCLS_SINGLEUSE, xrefs: 00007FFDFABD9606
DESCKIND_VARDESC, xrefs: 00007FFDFABDA35F
VT_ERROR, xrefs: 00007FFDFABD9DAA
COWAIT_WAITALL, xrefs: 00007FFDFABDA1A6
EOAC_ACCESS_CONTROL, xrefs: 00007FFDFABD9900
RPC_C_IMP_LEVEL_IMPERSONATE, xrefs: 00007FFDFABD9750
com_error, xrefs: 00007FFDFABD8CDE
PARAMFLAG_FHASDEFAULT, xrefs: 00007FFDFABD9564
TYPEFLAG_FOLEAUTOMATION, xrefs: 00007FFDFABD9B52
RPC_C_AUTHN_LEVEL_PKT_PRIVACY, xrefs: 00007FFDFABD96FF
EOAC_MUTUAL_AUTH, xrefs: 00007FFDFABD98D6
DISPID_VALUE, xrefs: 00007FFDFABD91BF
internal_error, xrefs: 00007FFDFABD8D0B
VT_STORED_OBJECT, xrefs: 00007FFDFABD9FE1
PARAMFLAG_NONE, xrefs: 00007FFDFABD94E6
EOAC_NO_CUSTOM_MARSHAL, xrefs: 00007FFDFABD99E7
DISPID_DESTRUCTOR, xrefs: 00007FFDFABD9198
CoGetObjectContext, xrefs: 00007FFDFABD8E5D
VT_STREAMED_OBJECT, xrefs: 00007FFDFABD9FCC
CLSCTX_ALL, xrefs: 00007FFDFABD8F28, 00007FFDFABDA38C
VT_UNKNOWN, xrefs: 00007FFDFABD9DE9
VT_CLSID, xrefs: 00007FFDFABDA020
VT_HRESULT, xrefs: 00007FFDFABD9ED0
VT_STORAGE, xrefs: 00007FFDFABD9FB7
RPC_C_AUTHN_DPA, xrefs: 00007FFDFABD9834
Nothing, xrefs: 00007FFDFABD8C66
VT_UI4, xrefs: 00007FFDFABD9E52
COINIT_APARTMENTTHREADED, xrefs: 00007FFDFABD8FBB
EOAC_SECURE_REFS, xrefs: 00007FFDFABD98EB
ole32.dll, xrefs: 00007FFDFABD8E38
VT_EMPTY, xrefs: 00007FFDFABD9CD8
fdexNameCaseInsensitive, xrefs: 00007FFDFABDA20F
fdexPropCanSourceEvents, xrefs: 00007FFDFABDA320
TKIND_COCLASS, xrefs: 00007FFDFABD9C36
COINIT_DISABLE_OLE1DDE, xrefs: 00007FFDFABD8FE2
DISPID_CONSTRUCTOR, xrefs: 00007FFDFABD9183
fdexPropCannotPutRef, xrefs: 00007FFDFABDA28D
FUNCFLAG_FDISPLAYBIND, xrefs: 00007FFDFABD92FA
MKSYS_CLASSMONIKER, xrefs: 00007FFDFABD94D4
CoInitializeSecurity, xrefs: 00007FFDFABD8EA2
VT_UI2, xrefs: 00007FFDFABD9E3D
VT_ARRAY, xrefs: 00007FFDFABDA05F
RPC_C_AUTHN_LEVEL_CONNECT, xrefs: 00007FFDFABD96AB
EXTCONN_WEAK, xrefs: 00007FFDFABD927C
IDLFLAG_FOUT, xrefs: 00007FFDFABD941A
FUNC_NONVIRTUAL, xrefs: 00007FFDFABD9375
ROTFLAGS_REGISTRATIONKEEPSALIVE, xrefs: 00007FFDFABD965A
_univgw, xrefs: 00007FFDFABD8E21
RPC_C_AUTHZ_DEFAULT, xrefs: 00007FFDFABD98AF
RPC_C_AUTHN_MSN, xrefs: 00007FFDFABD981F
fdexPropNoSideEffects, xrefs: 00007FFDFABDA2A2
VT_BLOB_OBJECT, xrefs: 00007FFDFABD9FF6
RPC_C_AUTHN_NONE, xrefs: 00007FFDFABD9777
TYMED_HGLOBAL, xrefs: 00007FFDFABD9036
pythoncom.internal_error, xrefs: 00007FFDFABD8CFC
fdexPropCannotGet, xrefs: 00007FFDFABDA239
DISPATCH_METHOD, xrefs: 00007FFDFABD916E
RPC_C_AUTHZ_DCE, xrefs: 00007FFDFABD989A
Empty, xrefs: 00007FFDFABD8BCA
fdexPropCannotSourceEvents, xrefs: 00007FFDFABDA335
DISPID_STARTENUM, xrefs: 00007FFDFABD9228
VT_VECTOR, xrefs: 00007FFDFABDA04A
VT_CF, xrefs: 00007FFDFABDA00B
INVOKE_PROPERTYGET, xrefs: 00007FFDFABD95CA
TYMED_NULL, xrefs: 00007FFDFABD90C6
VAR_CONST, xrefs: 00007FFDFABD9CB1
DISPID_PROPERTYPUT, xrefs: 00007FFDFABD91E9
DVASPECT_THUMBNAIL, xrefs: 00007FFDFABD90F0
MKSYS_NONE, xrefs: 00007FFDFABD9456
REGCLS_MULTI_SEPARATE, xrefs: 00007FFDFABD9630
PARAMFLAG_FIN, xrefs: 00007FFDFABD94FB
VT_DATE, xrefs: 00007FFDFABD9D6B
STDOLE2_MAJORVERNUM, xrefs: 00007FFDFABD9A35
VT_BSTR_BLOB, xrefs: 00007FFDFABDA035
DISPATCH_PROPERTYPUT, xrefs: 00007FFDFABD9144
VT_NULL, xrefs: 00007FFDFABD9CED
ACTIVEOBJECT_WEAK, xrefs: 00007FFDFABD8F13
EOAC_NONE, xrefs: 00007FFDFABD98C1
VT_UINT, xrefs: 00007FFDFABD9EA6
TYMED_MFPICT, xrefs: 00007FFDFABD909F
RPC_C_IMP_LEVEL_ANONYMOUS, xrefs: 00007FFDFABD9726
COWAIT_ALERTABLE, xrefs: 00007FFDFABDA1BB
EOAC_DEFAULT, xrefs: 00007FFDFABD99BD
CLSCTX_SERVER, xrefs: 00007FFDFABD8F52, 00007FFDFABDA3AB, 00007FFDFABDA3D3
InterfaceNames, xrefs: 00007FFDFABD8B32
FUNCFLAG_FUSESGETLASTERROR, xrefs: 00007FFDFABD9339
RPC_C_AUTHN_GSS_KERBEROS, xrefs: 00007FFDFABD980A
TKIND_INTERFACE, xrefs: 00007FFDFABD9C0C
fdexPropCanPut, xrefs: 00007FFDFABDA24E
TKIND_RECORD, xrefs: 00007FFDFABD9BE2
fdexPropDynamicType, xrefs: 00007FFDFABDA2B7
FUNC_PUREVIRTUAL, xrefs: 00007FFDFABD9360
RPC_C_AUTHN_DEFAULT, xrefs: 00007FFDFABD985E
TYMED_ISTORAGE, xrefs: 00007FFDFABD9075
VT_CY, xrefs: 00007FFDFABD9D56
TYPEFLAG_FLICENSED, xrefs: 00007FFDFABD9AD4
PARAMFLAG_FOUT, xrefs: 00007FFDFABD9510
VAR_STATIC, xrefs: 00007FFDFABD9C9C
VT_I1, xrefs: 00007FFDFABD9E13
TYMED_FILE, xrefs: 00007FFDFABD904B
VT_STREAM, xrefs: 00007FFDFABD9FA2
IDLFLAG_FLCID, xrefs: 00007FFDFABD942F
STREAM_SEEK_SET, xrefs: 00007FFDFABD9576
MSHCTX_DIFFERENTMACHINE, xrefs: 00007FFDFABDA104
TYPEFLAG_FAGGREGATABLE, xrefs: 00007FFDFABD9B7C
RPC_C_AUTHN_GSS_NEGOTIATE, xrefs: 00007FFDFABD97CB
URL_MK_LEGACY, xrefs: 00007FFDFABDA191

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Dict_String$Item$ReadyType_$AddressProc$DeallocFrom$D@@@Err_Object_ReferenceU_object@@$HandleModuleModule_$Create2LongLong_$ClearDictEnsure@@ExceptionGlobals_LibraryLoadMaskObjectOccurredSys_Unsigned
String ID: ACTIVEOBJECT_STRONG$ACTIVEOBJECT_WEAK$ArgNotFound$CLSCTX_ALL$CLSCTX_INPROC$CLSCTX_INPROC_HANDLER$CLSCTX_INPROC_SERVER$CLSCTX_LOCAL_SERVER$CLSCTX_REMOTE_SERVER$CLSCTX_SERVER$COINIT_APARTMENTTHREADED$COINIT_DISABLE_OLE1DDE$COINIT_MULTITHREADED$COINIT_SPEED_OVER_MEMORY$COWAIT_ALERTABLE$COWAIT_WAITALL$CoCreateInstanceEx$CoGetCancelObject$CoGetObjectContext$CoInitializeSecurity$CoWaitForMultipleHandles$CreateURLMonikerEx$DATADIR_GET$DATADIR_SET$DESCKIND_FUNCDESC$DESCKIND_VARDESC$DISPATCH_METHOD$DISPATCH_PROPERTYGET$DISPATCH_PROPERTYPUT$DISPATCH_PROPERTYPUTREF$DISPID_COLLECT$DISPID_CONSTRUCTOR$DISPID_DESTRUCTOR$DISPID_EVALUATE$DISPID_NEWENUM$DISPID_PROPERTYPUT$DISPID_STARTENUM$DISPID_THIS$DISPID_UNKNOWN$DISPID_VALUE$DVASPECT_CONTENT$DVASPECT_DOCPRINT$DVASPECT_ICON$DVASPECT_THUMBNAIL$EOAC_ACCESS_CONTROL$EOAC_ANY_AUTHORITY$EOAC_APPID$EOAC_AUTO_IMPERSONATE$EOAC_DEFAULT$EOAC_DISABLE_AAA$EOAC_DYNAMIC$EOAC_DYNAMIC_CLOAKING$EOAC_MAKE_FULLSIC$EOAC_MUTUAL_AUTH$EOAC_NONE$EOAC_NO_CUSTOM_MARSHAL$EOAC_REQUIRE_FULLSIC$EOAC_SECURE_REFS$EOAC_STATIC_CLOAKING$EXTCONN_CALLABLE$EXTCONN_STRONG$EXTCONN_WEAK$Empty$FMTID_DocSummaryInformation$FMTID_SummaryInformation$FMTID_UserDefinedProperties$FUNCFLAG_FBINDABLE$FUNCFLAG_FDEFAULTBIND$FUNCFLAG_FDISPLAYBIND$FUNCFLAG_FHIDDEN$FUNCFLAG_FREQUESTEDIT$FUNCFLAG_FRESTRICTED$FUNCFLAG_FSOURCE$FUNCFLAG_FUSESGETLASTERROR$FUNC_DISPATCH$FUNC_NONVIRTUAL$FUNC_PUREVIRTUAL$FUNC_STATIC$FUNC_VIRTUAL$IDLFLAG_FIN$IDLFLAG_FLCID$IDLFLAG_FOUT$IDLFLAG_FRETVAL$IDLFLAG_NONE$IMPLTYPEFLAG_FDEFAULT$IMPLTYPEFLAG_FRESTRICTED$IMPLTYPEFLAG_FSOURCE$INVOKE_FUNC$INVOKE_PROPERTYGET$INVOKE_PROPERTYPUT$INVOKE_PROPERTYPUTREF$InterfaceNames$MKSYS_ANTIMONIKER$MKSYS_CLASSMONIKER$MKSYS_FILEMONIKER$MKSYS_GENERICCOMPOSITE$MKSYS_ITEMMONIKER$MKSYS_NONE$MKSYS_POINTERMONIKER$MSHCTX_DIFFERENTMACHINE$MSHCTX_INPROC$MSHCTX_LOCAL$MSHCTX_NOSHAREDMEM$MSHLFLAGS_NOPING$MSHLFLAGS_NORMAL$MSHLFLAGS_TABLESTRONG$MSHLFLAGS_TABLEWEAK$Missing$Nothing$PARAMFLAG_FHASDEFAULT$PARAMFLAG_FIN$PARAMFLAG_FLCID$PARAMFLAG_FOPT$PARAMFLAG_FOUT$PARAMFLAG_FRETVAL$PARAMFLAG_NONE$REGCLS_MULTIPLEUSE$REGCLS_MULTI_SEPARATE$REGCLS_SINGLEUSE$REGCLS_SUSPENDED$ROTFLAGS_ALLOWANYCLIENT$ROTFLAGS_REGISTRATIONKEEPSALIVE$RPC_C_AUTHN_DCE_PRIVATE$RPC_C_AUTHN_DCE_PUBLIC$RPC_C_AUTHN_DEC_PUBLIC$RPC_C_AUTHN_DEFAULT$RPC_C_AUTHN_DPA$RPC_C_AUTHN_GSS_KERBEROS$RPC_C_AUTHN_GSS_NEGOTIATE$RPC_C_AUTHN_GSS_SCHANNEL$RPC_C_AUTHN_LEVEL_CALL$RPC_C_AUTHN_LEVEL_CONNECT$RPC_C_AUTHN_LEVEL_DEFAULT$RPC_C_AUTHN_LEVEL_NONE$RPC_C_AUTHN_LEVEL_PKT$RPC_C_AUTHN_LEVEL_PKT_INTEGRITY$RPC_C_AUTHN_LEVEL_PKT_PRIVACY$RPC_C_AUTHN_MQ$RPC_C_AUTHN_MSN$RPC_C_AUTHN_NONE$RPC_C_AUTHN_WINNT$RPC_C_AUTHZ_DCE$RPC_C_AUTHZ_DEFAULT$RPC_C_AUTHZ_NAME$RPC_C_AUTHZ_NONE$RPC_C_IMP_LEVEL_ANONYMOUS$RPC_C_IMP_LEVEL_DEFAULT$RPC_C_IMP_LEVEL_DELEGATE$RPC_C_IMP_LEVEL_IDENTIFY$RPC_C_IMP_LEVEL_IMPERSONATE$STDOLE2_LCID$STDOLE2_MAJORVERNUM$STDOLE2_MINORVERNUM$STDOLE_LCID$STDOLE_MAJORVERNUM$STDOLE_MINORVERNUM$STREAM_SEEK_CUR$STREAM_SEEK_END$STREAM_SEEK_SET$SYS_MAC$SYS_WIN16$SYS_WIN32$ServerInterfaces$TKIND_ALIAS$TKIND_COCLASS$TKIND_DISPATCH$TKIND_ENUM$TKIND_INTERFACE$TKIND_MODULE$TKIND_RECORD$TKIND_UNION$TYMED_ENHMF$TYMED_FILE$TYMED_GDI$TYMED_HGLOBAL$TYMED_ISTORAGE$TYMED_ISTREAM$TYMED_MFPICT$TYMED_NULL$TYPEFLAG_FAGGREGATABLE$TYPEFLAG_FAPPOBJECT$TYPEFLAG_FCANCREATE$TYPEFLAG_FCONTROL$TYPEFLAG_FDISPATCHABLE$TYPEFLAG_FDUAL$TYPEFLAG_FHIDDEN$TYPEFLAG_FLICENSED$TYPEFLAG_FNONEXTENSIBLE$TYPEFLAG_FOLEAUTOMATION$TYPEFLAG_FPREDECLID$TYPEFLAG_FREPLACEABLE$TYPEFLAG_FRESTRICTED$TYPEFLAG_FREVERSEBIND$TypeIIDs$URL_MK_LEGACY$URL_MK_UNIFORM$VARFLAG_FREADONLY$VAR_CONST$VAR_DISPATCH$VAR_PERINSTANCE$VAR_STATIC$VT_ARRAY$VT_BLOB$VT_BLOB_OBJECT$VT_BOOL$VT_BSTR$VT_BSTR_BLOB$VT_BYREF$VT_CARRAY$VT_CF$VT_CLSID$VT_CY$VT_DATE$VT_DECIMAL$VT_DISPATCH$VT_EMPTY$VT_ERROR$VT_FILETIME$VT_HRESULT$VT_I1$VT_I2$VT_I4$VT_I8$VT_ILLEGAL$VT_ILLEGALMASKED$VT_INT$VT_LPSTR$VT_LPWSTR$VT_NULL$VT_PTR$VT_R4$VT_R8$VT_RECORD$VT_RESERVED$VT_SAFEARRAY$VT_STORAGE$VT_STORED_OBJECT$VT_STREAM$VT_STREAMED_OBJECT$VT_TYPEMASK$VT_UI1$VT_UI2$VT_UI4$VT_UI8$VT_UINT$VT_UNKNOWN$VT_USERDEFINED$VT_VARIANT$VT_VECTOR$VT_VOID$_univgw$can't define ole_error$coinit_flags$com_error$dcom$error$fdexNameCaseInsensitive$fdexNameCaseSensitive$fdexNameEnsure$fdexNameImplicit$fdexPropCanCall$fdexPropCanConstruct$fdexPropCanGet$fdexPropCanPut$fdexPropCanPutRef$fdexPropCanSourceEvents$fdexPropCannotCall$fdexPropCannotConstruct$fdexPropCannotGet$fdexPropCannotPut$fdexPropCannotPutRef$fdexPropCannotSourceEvents$fdexPropDynamicType$fdexPropNoSideEffects$frozen$internal_error$ole32.dll$ole_error$pythoncom.internal_error$urlmon.dll
API String ID: 1000972437-3953899047
Opcode ID: 5afd2dc5eaf7789ad9265e16c99b19a15388047e6c94fa03f81536c0e236717b
Instruction ID: e286177f415e1c73cf91e64377943a75143a1fc6a242ab64531d77674badf0d2
Opcode Fuzzy Hash: 5afd2dc5eaf7789ad9265e16c99b19a15388047e6c94fa03f81536c0e236717b
Instruction Fuzzy Hash: 1CD23A5CB1860250FB0CA756D6B0BBC13A2AF46BC1F8464B1DC6D0BBDE9F6EB1058742

Function 00007FFDFAC81A0F Relevance: 144.4, APIs: 74, Strings: 8, Instructions: 858COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFDFACCACE7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACCACFF
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACCAE96
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACCAEAE
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FFDFACCAF96
EVP_CIPHER_get_flags.LIBCRYPTO-3 ref: 00007FFDFACCAF9E
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACCB00C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACCB024
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACCB191
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACCB1A9
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACCB1DA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACCB1F2
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFDFACCB213
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFDFACCB220
CRYPTO_memcmp.LIBCRYPTO-3 ref: 00007FFDFACCB2AA
ERR_set_mark.LIBCRYPTO-3 ref: 00007FFDFACCB2C6
ERR_clear_last_mark.LIBCRYPTO-3 ref: 00007FFDFACCB315
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACCB31F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACCB337
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFDFACCB496
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFDFACCB4B5
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACCBA16
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACCBA2E
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACCBA40
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACCBA4C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACCBA64

Strings

CONNE, xrefs: 00007FFDFACCB95A
ssl3_get_record, xrefs: 00007FFDFACCACF1, 00007FFDFACCAEA0, 00007FFDFACCB016, 00007FFDFACCB064, 00007FFDFACCB094, 00007FFDFACCB0BC, 00007FFDFACCB0E9, 00007FFDFACCB196, 00007FFDFACCB1DF, 00007FFDFACCB324, 00007FFDFACCB34C, 00007FFDFACCB3B8, 00007FFDFACCB439, 00007FFDFACCB593, 00007FFDFACCB743, 00007FFDFACCB7C2, 00007FFDFACCB7EF, 00007FFDFACCB821, 00007FFDFACCB855, 00007FFDFACCB887, 00007FFDFACCB973, 00007FFDFACCB9AD, 00007FFDFACCBA20, 00007FFDFACCBA51
, xrefs: 00007FFDFACCB187
POST , xrefs: 00007FFDFACCB90B
HEAD , xrefs: 00007FFDFACCB929
..\s\ssl\record\ssl3_record.c, xrefs: 00007FFDFACCACF8, 00007FFDFACCAEA7, 00007FFDFACCB01D, 00007FFDFACCB06B, 00007FFDFACCB09B, 00007FFDFACCB0C8, 00007FFDFACCB0F5, 00007FFDFACCB1A2, 00007FFDFACCB1EB, 00007FFDFACCB330, 00007FFDFACCB358, 00007FFDFACCB38F, 00007FFDFACCB3C4, 00007FFDFACCB445, 00007FFDFACCB489, 00007FFDFACCB4AB, 00007FFDFACCB74F, 00007FFDFACCB7CE, 00007FFDFACCB7FB, 00007FFDFACCB828, 00007FFDFACCB861, 00007FFDFACCB88E, 00007FFDFACCB97F, 00007FFDFACCB9B9, 00007FFDFACCBA27, 00007FFDFACCBA5D
GET , xrefs: 00007FFDFACCB8E8
PUT , xrefs: 00007FFDFACCB943

Memory Dump Source

Source File: 00000001.00000002.2948289465.00007FFDFAC81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDFAC80000, based on PE: true

Associated: 00000001.00000002.2948268208.00007FFDFAC80000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948289465.00007FFDFAD03000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948462756.00007FFDFAD2D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD32000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac80000_UpdaterTool.jbxd

Similarity

API ID: R_new$R_set_debug$O_free$D_get_sizeO_memcmpR_clear_last_markR_get_flagsR_set_markX_get0_cipherX_get0_md
String ID: $..\s\ssl\record\ssl3_record.c$CONNE$GET $HEAD $POST $PUT $ssl3_get_record
API String ID: 2283737721-2781224710
Opcode ID: 40243567b0c9e5d0b1d25a9c0806e483eb2da45cb6c3cb4bcf6ca79101e842da
Instruction ID: af2e47eb3a7166956e7cdd754484761a0c5b6a57418159e8b2f3c2451c45d7dc
Opcode Fuzzy Hash: 40243567b0c9e5d0b1d25a9c0806e483eb2da45cb6c3cb4bcf6ca79101e842da
Instruction Fuzzy Hash: 4E82D039B09AD281FB289B95D460BBD23A0EF81B48F5540B6DA6D4B6CDDF3CE585C310

Function 00007FF6E5781000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

VCRUNTIME140.dll, xrefs: 00007FF6E5783DB1
pyi-contents-directory, xrefs: 00007FF6E5783B8D
Failed to remove temporary directory: %s, xrefs: 00007FF6E5783FCF
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF6E5783882, 00007FF6E57838AF
pyi-python-flag, xrefs: 00007FF6E5783AD6
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6E5783971
Py_GIL_DISABLED, xrefs: 00007FF6E5783AF4
MEI, xrefs: 00007FF6E5783933
pkg, xrefs: 00007FF6E57839BE
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF6E5783A0B, 00007FF6E5783CD4, 00007FF6E5783F6B
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6E5783EBB
Failed to start splash screen!, xrefs: 00007FF6E5783ED4
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6E5783EA6
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF6E5783B32
_PYI_ARCHIVE_FILE, xrefs: 00007FF6E57838D2, 00007FF6E57839FF
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF6E5783A17, 00007FF6E5783A2F, 00007FF6E5783A9B
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF6E5783D35
Failed to load splash screen resources!, xrefs: 00007FF6E5783E85
pyi-runtime-tmpdir, xrefs: 00007FF6E5783B68
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6E57839DE
pyi-disable-windowed-traceback, xrefs: 00007FF6E5783BB2
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF6E5783E0A
Failed to convert DLL search path!, xrefs: 00007FF6E5783DDC
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6E5783BE8
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6E5783D12
Could not create temporary directory!, xrefs: 00007FF6E5783CBF
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6E5783C61
_PYI_SPLASH_IPC, xrefs: 00007FF6E5783A23, 00007FF6E5783EF5

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: d52c1960cc45de78c26c9f57622ace5a14626686e839aa839f1fc42fe00fc1f1
Instruction ID: b435d199805b71d04b19b9ff1d0c433f92d7a4571b6dc6ae0eb2abbcf6d6dc69
Opcode Fuzzy Hash: d52c1960cc45de78c26c9f57622ace5a14626686e839aa839f1fc42fe00fc1f1
Instruction Fuzzy Hash: 97328D63A0C6A291FE159B29D8743B92691AF44F80F444432DA5DC32D6EF2EED74C31B

Function 00007FF6E57A6964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E57A6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A66D9
Part of subcall function 00007FF6E57A6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A6757
Part of subcall function 00007FF6E57A6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A67A8

CreateFileW.KERNEL32 ref: 00007FF6E57A6A6A
CreateFileW.KERNEL32 ref: 00007FF6E57A6ABA
GetLastError.KERNEL32 ref: 00007FF6E57A6AEA
GetFileType.KERNEL32 ref: 00007FF6E57A6AFF
GetLastError.KERNEL32 ref: 00007FF6E57A6B09
CloseHandle.KERNEL32 ref: 00007FF6E57A6B3C
CloseHandle.KERNEL32 ref: 00007FF6E57A6C9F
CreateFileW.KERNEL32 ref: 00007FF6E57A6CD4
GetLastError.KERNEL32 ref: 00007FF6E57A6CE3

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: 4421cbd6fdc199937788354ee72bdcb638e34ef7e7338ff810c55c5a40e0f66a
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: D3C19F37B28A4185EF10CF69C4A06AC3761F749B98B114229DA1EDB795DF3AD871C305

Function 00007FF6E5789280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF6E57892B3
FindClose.KERNEL32 ref: 00007FF6E57892C2

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 630b7f02b40f1aa7360b7bdcb0121614811b3296479f4d059f18ce3c57669cb9
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: C2F0C823A1874186FFA08B60F4A876A7750EB84B64F040335DA6DC2AD5DF3DD878CB09

Function 00007FFDFAC81C1C Relevance: 70.6, APIs: 37, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFDFACC6EEC
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACC7113
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACC712B
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACC728B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACC72A3
BIO_clear_flags.LIBCRYPTO-3 ref: 00007FFDFACC730E
BIO_set_flags.LIBCRYPTO-3 ref: 00007FFDFACC731B
memcpy.VCRUNTIME140 ref: 00007FFDFACC735A
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACC747D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACC7495
memcpy.VCRUNTIME140 ref: 00007FFDFACC7510
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFDFACC7543
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACC75BB
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACC75D3
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACC75E8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACC7600
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACC76E8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACC7700
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACC7720
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACC7738
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACC774D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACC7765
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACC786E

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFDFACC7124, 00007FFDFACC729C, 00007FFDFACC748E, 00007FFDFACC75CC, 00007FFDFACC75F9, 00007FFDFACC7631, 00007FFDFACC766B, 00007FFDFACC76CC, 00007FFDFACC76F9, 00007FFDFACC7731, 00007FFDFACC775E, 00007FFDFACC77A6, 00007FFDFACC77CD, 00007FFDFACC7867
ssl3_read_bytes, xrefs: 00007FFDFACC7118, 00007FFDFACC7290, 00007FFDFACC7482, 00007FFDFACC75C0, 00007FFDFACC75ED, 00007FFDFACC7625, 00007FFDFACC765F, 00007FFDFACC76C0, 00007FFDFACC76ED, 00007FFDFACC7725, 00007FFDFACC7757, 00007FFDFACC779A, 00007FFDFACC77C6, 00007FFDFACC7860
SSL alert number %d, xrefs: 00007FFDFACC7682

Memory Dump Source

Source File: 00000001.00000002.2948289465.00007FFDFAC81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDFAC80000, based on PE: true

Associated: 00000001.00000002.2948268208.00007FFDFAC80000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948289465.00007FFDFAD03000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948462756.00007FFDFAD2D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD32000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac80000_UpdaterTool.jbxd

Similarity

API ID: R_newR_set_debug$memcpy$L_cleanseO_clear_flagsO_set_flags
String ID: ..\s\ssl\record\rec_layer_s3.c$SSL alert number %d$ssl3_read_bytes
API String ID: 480058824-3615793073
Opcode ID: 6ce1f1e6ab867371c9ac5fdbcfd9244af31884eb36a4143032fe0f8282fb1a6d
Instruction ID: 8c1c0ca34b27da31d0296cafa3eb1953e6f5ec62ee8119f82adf9db2a571788f
Opcode Fuzzy Hash: 6ce1f1e6ab867371c9ac5fdbcfd9244af31884eb36a4143032fe0f8282fb1a6d
Instruction Fuzzy Hash: BB52A039B086C282FB699B26D460BBD27A0EF81B48F5540B5DA6E07ADDDF3DE441C311

Function 00007FFDFAC814BF Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDFACDF1BC
SetLastError.KERNEL32 ref: 00007FFDFACDF1C3
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACDF2A4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACDF2BC
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACDF2E5
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACDF30A
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACDF32C
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACDF34D
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACDF372
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACDF39B
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACDF44B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACDF463
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACDF47E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACDF496
ERR_set_error.LIBCRYPTO-3 ref: 00007FFDFACDF4A8
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FFDFACDF4B3

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FFDFACDF2B5, 00007FFDFACDF45C, 00007FFDFACDF48F
state_machine, xrefs: 00007FFDFACDF2AE, 00007FFDFACDF450, 00007FFDFACDF483

Memory Dump Source

Source File: 00000001.00000002.2948289465.00007FFDFAC81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDFAC80000, based on PE: true

Associated: 00000001.00000002.2948268208.00007FFDFAC80000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948289465.00007FFDFAD03000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948462756.00007FFDFAD2D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD32000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac80000_UpdaterTool.jbxd

Similarity

API ID: R_new$R_set_debug$ErrorLastM_freeR_clear_errorR_set_error
String ID: ..\s\ssl\statem\statem.c$state_machine
API String ID: 1370845099-1722249466
Opcode ID: 0d32384d7316208965964d29d91abcf0daa34d1bc1be83e9d84aa4d08f48a424
Instruction ID: 69dc2ed0f6b9a647c48ef709a47ecd27aff406d0b529d1d300c4e1cfba188ce0
Opcode Fuzzy Hash: 0d32384d7316208965964d29d91abcf0daa34d1bc1be83e9d84aa4d08f48a424
Instruction Fuzzy Hash: 97A16229B0C64381FB6D9B2AD461BBD22A4FF41B48F2440B5DD7D466DECE3CE84187A1

Function 00007FFDFAC81C62 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFDFACE6014
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACE602C
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDFACE6061
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFDFACE6076
X509_get0_pubkey.LIBCRYPTO-3 ref: 00007FFDFACE6081
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACE60B7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACE60CF
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACE6114
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACE612C

Strings

tls_post_process_server_certificate, xrefs: 00007FFDFACE6019, 00007FFDFACE60BC, 00007FFDFACE6119, 00007FFDFACE61EB
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFDFACE6025, 00007FFDFACE60C8, 00007FFDFACE6125, 00007FFDFACE61F7

Memory Dump Source

Source File: 00000001.00000002.2948289465.00007FFDFAC81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDFAC80000, based on PE: true

Associated: 00000001.00000002.2948268208.00007FFDFAC80000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948289465.00007FFDFAD03000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948462756.00007FFDFAD2D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD32000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac80000_UpdaterTool.jbxd

Similarity

API ID: R_newR_set_debug$L_sk_valueR_clear_errorX509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c$tls_post_process_server_certificate
API String ID: 2779586248-3767186838
Opcode ID: 4b3c939a7b197642555fd03858451e68e0e2822e76a72f073d6beb959d7d97e5
Instruction ID: 86effb4f8d26ddb7e5ddb902e380dab026a36d9318272555967915f17ae07b0d
Opcode Fuzzy Hash: 4b3c939a7b197642555fd03858451e68e0e2822e76a72f073d6beb959d7d97e5
Instruction Fuzzy Hash: 3251B065B1968281FB59DB15D4A5BBC23A0FB84B88F5440B1EE6D4B7DEDF2CE8818310

Function 00007FFDFAC814F1 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFDFACC7C05
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACC7C1D
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACC7D0D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACC7D25
SetLastError.KERNEL32 ref: 00007FFDFACC7D72
BIO_read.LIBCRYPTO-3 ref: 00007FFDFACC7D99
BIO_test_flags.LIBCRYPTO-3 ref: 00007FFDFACC7DBC
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFDFACC7DD4
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACC7E2C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACC7E44
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACC7E95
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACC7EAD

Strings

ssl3_read_n, xrefs: 00007FFDFACC7C0A, 00007FFDFACC7D12, 00007FFDFACC7E31, 00007FFDFACC7E9A
..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFDFACC7C16, 00007FFDFACC7D1E, 00007FFDFACC7E3D, 00007FFDFACC7EA6

Memory Dump Source

Source File: 00000001.00000002.2948289465.00007FFDFAC81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDFAC80000, based on PE: true

Associated: 00000001.00000002.2948268208.00007FFDFAC80000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948289465.00007FFDFAD03000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948462756.00007FFDFAD2D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD32000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac80000_UpdaterTool.jbxd

Similarity

API ID: R_newR_set_debug$ErrorLastO_ctrlO_readO_test_flags
String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_read_n
API String ID: 3359833097-4226281315
Opcode ID: 8ebe03c6254369f7a723c3bcb68090796815b0d3cdd902c278eaeef658847182
Instruction ID: 43943dddd482edc4aaf9da0c01e43c4612ffff865d7db98cf5f34c14868baee2
Opcode Fuzzy Hash: 8ebe03c6254369f7a723c3bcb68090796815b0d3cdd902c278eaeef658847182
Instruction Fuzzy Hash: B0A17D29B08A8681F7599F26D860BBD22A0EF84B88F5541B5DE6D0BBDDDF3CD445C310

Function 00007FF6E5781950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E5787F90: _fread_nolock.LIBCMT ref: 00007FF6E578803A

_fread_nolock.LIBCMT ref: 00007FF6E5781A1B

Part of subcall function 00007FF6E5782910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6E5781B6A), ref: 00007FF6E578295E

Strings

Could not allocate buffer for TOC!, xrefs: 00007FF6E5781B1B
malloc, xrefs: 00007FF6E5781B22
Error on file., xrefs: 00007FF6E5781B8D
Could not allocate memory for archive structure!, xrefs: 00007FF6E5781A61
Failed to seek to cookie position!, xrefs: 00007FF6E57819EE
fseek, xrefs: 00007FF6E57819F5
Failed to read cookie!, xrefs: 00007FF6E5781A2B
calloc, xrefs: 00007FF6E5781A68
Could not read full TOC!, xrefs: 00007FF6E5781B55
MEI, xrefs: 00007FF6E5781991
fread, xrefs: 00007FF6E5781A32, 00007FF6E5781B5C

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: b426b7569fd43417053a9482fb0298cff99dadbc456d732c1d031cb9eee9613e
Instruction ID: 4c53e56441b76c422e068cc02e0c32acbb3628e2dc84878d151be5534d65095b
Opcode Fuzzy Hash: b426b7569fd43417053a9482fb0298cff99dadbc456d732c1d031cb9eee9613e
Instruction Fuzzy Hash: 4A819173A086D286EF20DB24D0643B927A1AF84F84F444431D98DC7786DE3EE9B5875B

Function 00007FFDFACDECC0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

read_state_machine, xrefs: 00007FFDFACDEF4D, 00007FFDFACDEF8A, 00007FFDFACDEFB2, 00007FFDFACDF025
..\s\ssl\statem\statem.c, xrefs: 00007FFDFACDEF54, 00007FFDFACDEF91, 00007FFDFACDEFBE, 00007FFDFACDF031

Memory Dump Source

Source File: 00000001.00000002.2948289465.00007FFDFAC81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDFAC80000, based on PE: true

Associated: 00000001.00000002.2948268208.00007FFDFAC80000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948289465.00007FFDFAD03000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948462756.00007FFDFAD2D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD32000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac80000_UpdaterTool.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem.c$read_state_machine
API String ID: 0-3323778802
Opcode ID: c8972936501a879b7e84c5051af7770807ba9d65b882bacb7b5450dec163fd8f
Instruction ID: 876b18245837c21516a479a066d0b040126b1a487fc7939b414083dbcf6b25b8
Opcode Fuzzy Hash: c8972936501a879b7e84c5051af7770807ba9d65b882bacb7b5450dec163fd8f
Instruction Fuzzy Hash: FF917029B0864681FB599B26D460BBD27A0FF40B48F5480B6DA7D4B6DDCF3CE846C350

Function 00007FFDFABE40B0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 54
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?PyWin_AcquireGlobalLock@@YAXXZ.PYWINTYPES313(?,?,?,?,?,00007FFDFABD4322), ref: 00007FFDFABE40BF
GetCurrentThreadId.KERNEL32 ref: 00007FFDFABE40CF
GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FFDFABD4322), ref: 00007FFDFABE40E8
GetProcAddress.KERNEL32(?,?,?,?,?,00007FFDFABD4322), ref: 00007FFDFABE4104
?PyWin_ReleaseGlobalLock@@YAXXZ.PYWINTYPES313(?,?,?,?,?,00007FFDFABD4322), ref: 00007FFDFABE4160

Strings

CoInitializeEx, xrefs: 00007FFDFABE40FA
CoInitializeEx failed (0x%08lx), xrefs: 00007FFDFABE412D
ole32.dll, xrefs: 00007FFDFABE40E1

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: GlobalLock@@Win_$AcquireAddressCurrentHandleModuleProcReleaseThread
String ID: CoInitializeEx$CoInitializeEx failed (0x%08lx)$ole32.dll
API String ID: 2699693448-4213856137
Opcode ID: 8a952fc43bd525437a0d6f348abac8e58cc68f4b7ebf1dc6150318704ae46fdd
Instruction ID: 338b11ccd8f66f9725e5b63d8290c735aa913e995718916df0da7156e0499d6c
Opcode Fuzzy Hash: 8a952fc43bd525437a0d6f348abac8e58cc68f4b7ebf1dc6150318704ae46fdd
Instruction Fuzzy Hash: 32218128F0C20385FB5CCB20A8B4E3D26916F55744F9440F8C52D862E9EE6EF884A602

Function 00007FFDFACDF6B0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3(?,?,FFFFFFFF,00000000,00007FFDFACDF416), ref: 00007FFDFACDF762
ERR_set_debug.LIBCRYPTO-3(?,?,FFFFFFFF,00000000,00007FFDFACDF416), ref: 00007FFDFACDF77A

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FFDFACDF773, 00007FFDFACDFA62
write_state_machine, xrefs: 00007FFDFACDF76C, 00007FFDFACDFA5B

Memory Dump Source

Source File: 00000001.00000002.2948289465.00007FFDFAC81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDFAC80000, based on PE: true

Associated: 00000001.00000002.2948268208.00007FFDFAC80000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948289465.00007FFDFAD03000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948462756.00007FFDFAD2D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD32000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac80000_UpdaterTool.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem.c$write_state_machine
API String ID: 193678381-552286378
Opcode ID: e5d1fe94fccde403d4ccffd35c49600b4c13cc4e7178492653a3fc2a8d140b00
Instruction ID: 58c88106db033d427fa4316e771d3b170f18393625b180751f9293852dd1c5b5
Opcode Fuzzy Hash: e5d1fe94fccde403d4ccffd35c49600b4c13cc4e7178492653a3fc2a8d140b00
Instruction Fuzzy Hash: DAA19D2AB0864281EB699F26D460BBD23A0FF40B48F544076CA6D4B6DDDE3DE945C790

Function 00007FF6E5781470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF6E578151F
fseek, xrefs: 00007FF6E57814E5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6E57814DE
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6E57815DF
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6E578149F
fread, xrefs: 00007FF6E57815E6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6E5781518

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 72f99dadd0a2177c1d42b060d7648ca84eb7dddf70f4030becfdb2944091b5e7
Instruction ID: fa39254ce2afc7f5f1275155fe194beac0db39c091bc86833a5bf56acfbd87cd
Opcode Fuzzy Hash: 72f99dadd0a2177c1d42b060d7648ca84eb7dddf70f4030becfdb2944091b5e7
Instruction Fuzzy Hash: 16418E23B0869286EE10DB2294207B96391BF44F94F444932ED1DC7B96DE3EED75870B

Function 00007FF6E5781210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6E57812BA
malloc, xrefs: 00007FF6E57812C1, 00007FF6E57812F6
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6E57812EF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6E5781276
1.3.1, xrefs: 00007FF6E5781249
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6E578141E

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 4176682b56444a78b74e0a45c684f191b40491c6c63e868bb09f8baa48a37ad0
Instruction ID: 04cb32d66c15de951b6a7770d9b094148f0a76274542a0abc184ab17383fac48
Opcode Fuzzy Hash: 4176682b56444a78b74e0a45c684f191b40491c6c63e868bb09f8baa48a37ad0
Instruction Fuzzy Hash: 8A51F423A0869285EE609B11A4603BA6291FF85F94F444131ED4DC7BD6EE3EEC71C70B

Function 00007FF6E57836B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6E5783804), ref: 00007FF6E57836E1
GetLastError.KERNEL32(?,00007FF6E5783804), ref: 00007FF6E57836EB

Part of subcall function 00007FF6E5782C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E5783706,?,00007FF6E5783804), ref: 00007FF6E5782C9E
Part of subcall function 00007FF6E5782C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6E5783706,?,00007FF6E5783804), ref: 00007FF6E5782D63
Part of subcall function 00007FF6E5782C50: MessageBoxW.USER32 ref: 00007FF6E5782D99

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF6E5783739
Failed to convert executable path to UTF-8., xrefs: 00007FF6E5783790
Failed to obtain executable path., xrefs: 00007FF6E57836F3
\\?\, xrefs: 00007FF6E578375A
GetModuleFileNameW, xrefs: 00007FF6E57836FA

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: 5b0fec96b832982856d0075ac314ea0618ec70d315b532f091164405fb2f4e42
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 9F21B753B1895291FE209725EC703B62254BF44B94F800131EA5EC65D6EE2EED34C30B

Function 00007FF6E579BA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E579BE89

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction ID: b3bb25ea907e6c21243a0528ec2b95cf3cf68bb4d61e4bd289e7f6af573058a9
Opcode Fuzzy Hash: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction Fuzzy Hash: 52C1E12390C68681EE609B1590643BD2FA5FB81F80F574135EA4DC3391CE7EEC75872A

Function 00007FFDFACF15A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFDFACF16C6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACF16DE
ERR_new.LIBCRYPTO-3 ref: 00007FFDFACF1761
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFACF1779

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFDFACF16D7, 00007FFDFACF1772
tls_get_message_header, xrefs: 00007FFDFACF16CB, 00007FFDFACF1766

Memory Dump Source

Source File: 00000001.00000002.2948289465.00007FFDFAC81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDFAC80000, based on PE: true

Associated: 00000001.00000002.2948268208.00007FFDFAC80000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948289465.00007FFDFAD03000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948462756.00007FFDFAD2D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD32000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac80000_UpdaterTool.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_get_message_header
API String ID: 193678381-2714770296
Opcode ID: f45773da2448751231a1ca749fc05bc9d2df97a6a3f744ec35cbeb086fc78321
Instruction ID: faee9df315cb6be5369e2f200d65e37a0ca560b0adde036ea7273db68cbc9933
Opcode Fuzzy Hash: f45773da2448751231a1ca749fc05bc9d2df97a6a3f744ec35cbeb086fc78321
Instruction Fuzzy Hash: 4F614A36B087C285EB588F25E560BAD37A0FB45B48F188076DB9D87799DF3CD4548720

Function 00007FF6E5786360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Failed to load Python DLL '%ls'., xrefs: 00007FF6E57864A7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF6E5786407
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF6E57863C7
LoadLibrary, xrefs: 00007FF6E57864AE
ucrtbase.dll, xrefs: 00007FF6E57863DD
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF6E5786456

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction ID: b1b471b0bde8407fdf8a3984a7dbc7e0e2b9f790d63925557c86df373d90959b
Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction Fuzzy Hash: 0E419423A1C696A1EE10DB10E4243E96355FF54B44F800132EA5DC7696EF3DEA35C347

Function 00007FFDFAC9FD40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFDFAC9FD62
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFDFAC9FD7A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFDFAC9FD8C
ASYNC_get_current_job.LIBCRYPTO-3 ref: 00007FFDFAC9FDDB

Strings

SSL_do_handshake, xrefs: 00007FFDFAC9FD67
..\s\ssl\ssl_lib.c, xrefs: 00007FFDFAC9FD73

Memory Dump Source

Source File: 00000001.00000002.2948289465.00007FFDFAC81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDFAC80000, based on PE: true

Associated: 00000001.00000002.2948268208.00007FFDFAC80000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948289465.00007FFDFAD03000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948462756.00007FFDFAD2D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD32000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac80000_UpdaterTool.jbxd

Similarity

API ID: C_get_current_jobR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_do_handshake
API String ID: 2134390360-2964568172
Opcode ID: 3e19f5133db6f9f0995d995d45ee5f37c3958f709a5efffcd3d50ec949d9a66b
Instruction ID: da5fc589374c5ac8998da85fc0aa2c6f8e20b9bdc6fdb46506a2773828fa8590
Opcode Fuzzy Hash: 3e19f5133db6f9f0995d995d45ee5f37c3958f709a5efffcd3d50ec949d9a66b
Instruction Fuzzy Hash: FC21D626F0868242F749AB35E4217BD2351EF88B98F584271E96D0A7CEDE2CE4818650

Function 00007FFDFABE2D10 Relevance: 9.1, APIs: 6, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

PyDict_New.PYTHON313(?,?,?,?,00007FFDFABE3FBB,?,?,?,?,00000000,00007FFDFABCCDCA,?,?,?,00007FFDFABC2353), ref: 00007FFDFABE2D25
PyDict_New.PYTHON313(?,?,?,?,00007FFDFABE3FBB,?,?,?,?,00000000,00007FFDFABCCDCA,?,?,?,00007FFDFABC2353), ref: 00007FFDFABE2D3B
PyDict_New.PYTHON313(?,?,?,?,00007FFDFABE3FBB,?,?,?,?,00000000,00007FFDFABCCDCA,?,?,?,00007FFDFABC2353), ref: 00007FFDFABE2D51
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313(?,?,?,?,00007FFDFABE3FBB,?,?,?,?,00000000,00007FFDFABCCDCA,?,?,?,00007FFDFABC2353), ref: 00007FFDFABE2DC8
PyDict_SetItem.PYTHON313(?,?,?,?,00007FFDFABE3FBB,?,?,?,?,00000000,00007FFDFABCCDCA,?,?,?,00007FFDFABC2353), ref: 00007FFDFABE2DE3
_Py_Dealloc.PYTHON313(?,?,?,?,00007FFDFABE3FBB,?,?,?,?,00000000,00007FFDFABCCDCA,?,?,?,00007FFDFABC2353), ref: 00007FFDFABE2DF9

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Dict_$D@@@DeallocFromItemObject_U_object@@
String ID:
API String ID: 493995867-0
Opcode ID: 4678b19076b3a4f207a4dd67704a6fba1b1dadb53973435a99e6f3baca2fd851
Instruction ID: 09f331f651181f1ca9f5fe0e8604933f48959f330b7a9d767d65fba946f3f069
Opcode Fuzzy Hash: 4678b19076b3a4f207a4dd67704a6fba1b1dadb53973435a99e6f3baca2fd851
Instruction Fuzzy Hash: C1313C29F09B5285FF5D9B14A4A4B7932A5FF44B90F8801B5DA2D423DCEF2CE8508341

Function 00007FF6E5795628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5795655
CreateFileW.KERNEL32 ref: 00007FF6E5795694
CloseHandle.KERNEL32 ref: 00007FF6E57956C9

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: 33974b73b0be635f95206d5451cbbd7df3dd0451dbb791a2882e1bf961cfc4d3
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: F8418123D2879283EB508F20D5603696760FF94BA4F119335EA9C83AD2DF7DA9F08715

Function 00007FF6E578CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E578CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6E578CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6E578CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF6E578CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6E578CD21

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 05bb0bea18d81b239c05cb3fb1e89d83595bb84ce170ea995cf784114a5e6fce
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 52313923E0826681FE54BB6594723B91685AF45F84F455034DA0DCB2D3DE2FBC34831B

Function 00007FFDFACDF070 Relevance: 3.3, APIs: 2, Instructions: 303COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDFACDF1BC
SetLastError.KERNEL32 ref: 00007FFDFACDF1C3
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FFDFACDF4B3

Memory Dump Source

Source File: 00000001.00000002.2948289465.00007FFDFAC81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDFAC80000, based on PE: true

Associated: 00000001.00000002.2948268208.00007FFDFAC80000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948289465.00007FFDFAD03000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948462756.00007FFDFAD2D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD32000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac80000_UpdaterTool.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: 8603938ac5e1fbf28ba7d9b8f40a04eb8b77d7e104ff7c3c46d49aacb8bdd123
Instruction ID: 309e0207099ca77b5c4d3562b7a277a54532abd31c581a4767b62c9ec5a1d9b8
Opcode Fuzzy Hash: 8603938ac5e1fbf28ba7d9b8f40a04eb8b77d7e104ff7c3c46d49aacb8bdd123
Instruction Fuzzy Hash: 7821C93AF0834286F76C9E26A861A7D36E0FF00B58F188475DA7D462DDDE38E441C7A1

Function 00007FF6E579013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5790180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5790277

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: f85e69355c849c9989385d362b28a38bc26b9a0b59948c9a8f2d23a9d9d73d35
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 30511823B2924186EF64DA25942077E6691BF44FA4F1A4634DD7DC37C5CE3EEC30862A

Function 00007FFDFAC81DF7 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FFDFACDF1BC
SetLastError.KERNEL32 ref: 00007FFDFACDF1C3
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FFDFACDF4B3

Memory Dump Source

Source File: 00000001.00000002.2948289465.00007FFDFAC81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDFAC80000, based on PE: true

Associated: 00000001.00000002.2948268208.00007FFDFAC80000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948289465.00007FFDFAD03000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948462756.00007FFDFAD2D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD32000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac80000_UpdaterTool.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: 9e1f5a9259e0aa48b60180f011c1c6fd63c9391dcfad61ef29b2cdf2ae2c5ec5
Instruction ID: aeb280a98c352c2fe29e866bd69b949418ee28dbe821ff7bdba20cfafbb5f135
Opcode Fuzzy Hash: 9e1f5a9259e0aa48b60180f011c1c6fd63c9391dcfad61ef29b2cdf2ae2c5ec5
Instruction Fuzzy Hash: 3721C63AF0824285F76C5E269860A7D26D0FF40B44F2480B5D93D462DDCE3CE941C7A1

Function 00007FF6E579C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF6E579C2CD), ref: 00007FF6E579C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF6E579C2CD), ref: 00007FF6E579C18A

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 8a6036abc1f661d46dbcb156fcaf58e24f8aeed5622670d911bcfa3c3512a2bd
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 8811EF62618A8181DE208B25A820269A361AB85FF0F540331EE7DCB7E9CE3DD8308709

Function 00007FF6E579AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF6E579A9D5,?,?,00000000,00007FF6E579AA8A), ref: 00007FF6E579ABC6
GetLastError.KERNEL32(?,?,?,00007FF6E579A9D5,?,?,00000000,00007FF6E579AA8A), ref: 00007FF6E579ABD0

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 637fb9be61b830893466d697cf975e9d54107538ca6ae010dfcf86c2584f4804
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 99210813F0D68201FEA0979594B037D16929F84F90F0A0238D96EC77C2CE6EEC70431A

Function 00007FF6E579BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E579BED4

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: 109b2fe229f27420485463cbf3ab81e80e8ae027e2a6e44ba56847c0641b628b
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 4041D27391D24187EE248A19A4603797BA1EB55F80F150135EA8EC37D1CF2EE832CB66

Function 00007FFDFACDEDB0 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

BUF_MEM_grow_clean.LIBCRYPTO-3(?,?,?,FFFFFFFF,00000000,?,00007FFDFACDF3FE), ref: 00007FFDFACDEE57

Memory Dump Source

Source File: 00000001.00000002.2948289465.00007FFDFAC81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDFAC80000, based on PE: true

Associated: 00000001.00000002.2948268208.00007FFDFAC80000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948289465.00007FFDFAD03000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948462756.00007FFDFAD2D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD32000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac80000_UpdaterTool.jbxd

Similarity

API ID: M_grow_clean
String ID:
API String ID: 964628749-0
Opcode ID: 1aa8bc403af585d6ad140d3c981c2ccf0944b06950901931b16cc14dda0e7e7d
Instruction ID: 5ed9d9ff64725fb90e7bfe0dcd1007e57baab2fbb9791faabee7ae00e002b0a5
Opcode Fuzzy Hash: 1aa8bc403af585d6ad140d3c981c2ccf0944b06950901931b16cc14dda0e7e7d
Instruction Fuzzy Hash: 27416D3AB0968686EB689F26D46077D2791FB40B88F188175CA7D4B7DCCF38E841C750

Function 00007FF6E5787F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6E578803A

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 479405c7ef634ee4bdd4ed85459738d9743f05c8c4b8da07aaad499d404441fa
Instruction ID: 3c6d1715586e31ef05ec306b2075db5ac3a7ed67785771f5256eddfa68256070
Opcode Fuzzy Hash: 479405c7ef634ee4bdd4ed85459738d9743f05c8c4b8da07aaad499d404441fa
Instruction Fuzzy Hash: 7821AD13B1866245FE509A1269247B95651BF45FC4F8D4430DE0DCB746CE7EE871C70B

Function 00007FF6E579B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E579B9C2

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: 80c83dd5f771e20f7c1f56a3950d876b93bda5459f22742e76a842be4c018733
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: 7F318F23A2C64281EA116B55946537C2AA1BF80FA0F430135E95DC73D2CE7EACB1872B

Function 00007FF6E5795F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5795EF9

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 5759d6a29f0dd222a70ae74b56062fd9afea943b1e1c602e80b8f7332003ff42
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 31118363A2965241EE609F1194203796261BF85F80F460035EA8CD7A95CF3EDC70472A

Function 00007FF6E57A6354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E57A6377

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 3481a6859c8c55bc28b88c3e318470f0a9f07f8030ce9607f1846aa2784fefae
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: D321B073A1CA4286DF619F28D45037976A0BB84F54F244234EA5EC76DADF3ED8318B05

Function 00007FF6E57903BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E5790410

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 4a5a880bdeb80a001d695a690e5773d9721348df64cd1ae73c63d6951491f422
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: E90108A2A2874140EE40DF525910269A7A1BF92FE0F4A4230EE5CD3BE6CE3ED8318315

Function 00007FFDFAC81D48 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFDFACDF678

Memory Dump Source

Source File: 00000001.00000002.2948289465.00007FFDFAC81000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDFAC80000, based on PE: true

Associated: 00000001.00000002.2948268208.00007FFDFAC80000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948289465.00007FFDFAD03000.00000020.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948418571.00007FFDFAD05000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948462756.00007FFDFAD2D000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD32000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD38000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000001.00000002.2948488076.00007FFDFAD40000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac80000_UpdaterTool.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: c921bd486a97e7f46db7fcb7af9098ff3867d55a4c011b1e5539e085f49d76b1
Instruction ID: 1541415adda5273975c7c32653b12f15d788d76dcb9ab9fa30396451e614ebed
Opcode Fuzzy Hash: c921bd486a97e7f46db7fcb7af9098ff3867d55a4c011b1e5539e085f49d76b1
Instruction Fuzzy Hash: 96E026E6F0400243F32417799856F6D12A0EF8C718F641074EE2C86BCADAADDCE38654

Function 00007FF6E5788E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E5789390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E57845F4,00000000,00007FF6E5781985), ref: 00007FF6E57893C9

LoadLibraryExW.KERNEL32(?,00007FF6E5786476,?,00007FF6E578336E), ref: 00007FF6E5788EA2

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction ID: 2fde23937ccc20e6555fd4ec77cdb87c5a7bc83104135a94be529625635e0ddc
Opcode Fuzzy Hash: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction Fuzzy Hash: 1ED0C212F3429642EE44A767BA5673A5252AF89FC0F88C035EE0D83B4ADC3DC8B14B04

Function 00007FF6E579D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6E5790C90,?,?,?,00007FF6E57922FA,?,?,?,?,?,00007FF6E5793AE9), ref: 00007FF6E579D63A

Memory Dump Source

Source File: 00000001.00000002.2946737341.00007FF6E5781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E5780000, based on PE: true

Associated: 00000001.00000002.2946707308.00007FF6E5780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946774564.00007FF6E57AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946821228.00007FF6E57C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2946877241.00007FF6E57C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6e5780000_UpdaterTool.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 13e1013eeecf3b1ba1c3488490e1c63855af920ad1c0616257256ae496332831
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: DFF03A16A0928240FE565AB1586577612915F88FE0F0A0630DD2EC62C2DE2EACB0812A

Non-executed Functions

Function 00007FFDFABEA880 Relevance: 68.5, APIs: 24, Strings: 15, Instructions: 237threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABEA905
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABEA923
PyErr_Occurred.PYTHON313 ref: 00007FFDFABEA936
PyErr_SetString.PYTHON313 ref: 00007FFDFABEA952
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABEA97B
PyErr_Format.PYTHON313 ref: 00007FFDFABEA99E
PyErr_SetString.PYTHON313 ref: 00007FFDFABEA9C2
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABEA9CF
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABEA9F5
PyObject_GetAttrString.PYTHON313 ref: 00007FFDFABEAA2A
PyErr_Clear.PYTHON313 ref: 00007FFDFABEAA38
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABEAB3E
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABEABBE
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABEABED
Py_BuildValue.PYTHON313 ref: 00007FFDFABEAC89
CoTaskMemFree.OLE32 ref: 00007FFDFABEAC9A

Strings

_oleobj_, xrefs: 00007FFDFABEAA20
AuthInfo, xrefs: 00007FFDFABEAC2C
The Python instance can not be converted to a COM object, xrefs: 00007FFDFABEAA3E
argument is not a COM object (got type=%s), xrefs: 00007FFDFABEA989, 00007FFDFABEAA89
None is not a valid interface object in this context, xrefs: 00007FFDFABEA8EC, 00007FFDFABEA968, 00007FFDFABEAA5A
AuthnSvc, xrefs: 00007FFDFABEAC09
ServerPrincipalName, xrefs: 00007FFDFABEAC72
The Python object is invalid, xrefs: 00007FFDFABEA89B
{s:k, s:k, s:N, s:k, s:k, s:O, s:k}, xrefs: 00007FFDFABEAC66
The Python object is NULL and no error occurred, xrefs: 00007FFDFABEA941
ImpLevel, xrefs: 00007FFDFABEAC43
AuthzSvc, xrefs: 00007FFDFABEABFA
Capabilities, xrefs: 00007FFDFABEAC14
O:QueryBlanket, xrefs: 00007FFDFABEA8C8
AuthnLevel, xrefs: 00007FFDFABEAC5A

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$Eval_Object_StringThread$InstanceRestoreSave$AttrBuildClearFormatFreeFromOccurredTaskU_object@@Value
String ID: AuthInfo$AuthnLevel$AuthnSvc$AuthzSvc$Capabilities$ImpLevel$None is not a valid interface object in this context$O:QueryBlanket$ServerPrincipalName$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$The Python object is invalid$_oleobj_$argument is not a COM object (got type=%s)${s:k, s:k, s:N, s:k, s:k, s:O, s:k}
API String ID: 524826855-701739339
Opcode ID: 08d822bdeb83b6d7e03afaa67bfe1e0f3924da3af12c117e9b466ecddb885818
Instruction ID: 54703285e562be579aa2ca2263b6cb3069cb3ef698d7a69d6922691e93111632
Opcode Fuzzy Hash: 08d822bdeb83b6d7e03afaa67bfe1e0f3924da3af12c117e9b466ecddb885818
Instruction Fuzzy Hash: 25C14F29B08B4295FB18DB55E4A0ABD63A5FF84B95F8440B6CA6D43798DF3CE449C340

Function 00007FFDFABECB70 Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 207threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABECC1B
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABECC43
PyErr_Occurred.PYTHON313 ref: 00007FFDFABECC56
PyErr_SetString.PYTHON313 ref: 00007FFDFABECC72
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABECC9B
PyErr_Format.PYTHON313 ref: 00007FFDFABECCBE
PyErr_SetString.PYTHON313 ref: 00007FFDFABECCE2
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABECCEF
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABECD12

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

PyObject_GetAttrString.PYTHON313 ref: 00007FFDFABECD47
PyErr_Clear.PYTHON313 ref: 00007FFDFABECD55
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABECE58
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABECE8B

Strings

_oleobj_, xrefs: 00007FFDFABECD3D
The Python object is NULL and no error occurred, xrefs: 00007FFDFABECC61
The Python instance can not be converted to a COM object, xrefs: 00007FFDFABECD5B
argument is not a COM object (got type=%s), xrefs: 00007FFDFABECCA9, 00007FFDFABECDA6
None is not a valid interface object in this context, xrefs: 00007FFDFABECC05, 00007FFDFABECC88, 00007FFDFABECD77
OkO:SetProperty, xrefs: 00007FFDFABECBD0
The Python object is invalid, xrefs: 00007FFDFABECB97

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_$RestoreSave$Object_String$DeallocInstance$AttrBuildClearErrorFormatFromInfoObjectOccurredU_object@@Value
String ID: None is not a valid interface object in this context$OkO:SetProperty$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$The Python object is invalid$_oleobj_$argument is not a COM object (got type=%s)
API String ID: 512730831-2279418479
Opcode ID: 9404b9c377235376456b046102f0916b338ca491dd8fcc18aa92ad109500faf8
Instruction ID: e6df3441a8f589e7d5733abf3a298422bd86654e6ac799b884b105357c8cbaab
Opcode Fuzzy Hash: 9404b9c377235376456b046102f0916b338ca491dd8fcc18aa92ad109500faf8
Instruction Fuzzy Hash: 20A11C69B08A4291FB589B55E8B497D23A1FF45B84F8444B2D92E473ECDF3CE805C381

Function 00007FFDFABEDA90 Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 200threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABEDAAF
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABEDAE1
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABEDB0F
PyErr_Occurred.PYTHON313 ref: 00007FFDFABEDB22
PyErr_SetString.PYTHON313 ref: 00007FFDFABEDB3E
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABEDB6F
PyErr_Format.PYTHON313 ref: 00007FFDFABEDB92
PyErr_SetString.PYTHON313 ref: 00007FFDFABEDBB6
PyObject_GetAttrString.PYTHON313 ref: 00007FFDFABEDC15
PyErr_Clear.PYTHON313 ref: 00007FFDFABEDC23
PyErr_SetString.PYTHON313 ref: 00007FFDFABEDC3A
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABEDD29
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABEDD5C
PyLong_FromLong.PYTHON313 ref: 00007FFDFABEDD84

Strings

_oleobj_, xrefs: 00007FFDFABEDC0B
The Python object is NULL and no error occurred, xrefs: 00007FFDFABEDB34
O:AddRefTypeInfo, xrefs: 00007FFDFABEDADA
The Python instance can not be converted to a COM object, xrefs: 00007FFDFABEDC30
argument is not a COM object (got type=%s), xrefs: 00007FFDFABEDB7D, 00007FFDFABEDC7D
The Python object is invalid, xrefs: 00007FFDFABEDAA1

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$String$Object_$Eval_InstanceThread$Arg_AttrClearFormatFromLongLong_OccurredParseRestoreSaveTuple
String ID: O:AddRefTypeInfo$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$The Python object is invalid$_oleobj_$argument is not a COM object (got type=%s)
API String ID: 2195012383-864360029
Opcode ID: a8f7af0e8907f2e740bfe25616abf3bf2ce9193e680f25f711d60d71c6f6d13c
Instruction ID: 50e07e0af7a13f633d9719c178ce21c04520d970088a79ba4c4b02805c9f3a70
Opcode Fuzzy Hash: a8f7af0e8907f2e740bfe25616abf3bf2ce9193e680f25f711d60d71c6f6d13c
Instruction Fuzzy Hash: A6914F29B08A4291FB08DF65E8B497D63E1FF44B94B8444B2CA2D876D8DFBCE855C301

Function 00007FFDFABD7B40 Relevance: 45.7, APIs: 19, Strings: 7, Instructions: 156threadlibraryloaderCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABD7B80
?PyWinLong_AsVoidPtr@@YAHPEAU_object@@PEAPEAX@Z.PYWINTYPES313 ref: 00007FFDFABD7B98
?PyWinLong_AsVoidPtr@@YAHPEAU_object@@PEAPEAX@Z.PYWINTYPES313 ref: 00007FFDFABD7BB0
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABD7BCD
LoadLibraryW.KERNEL32 ref: 00007FFDFABD7BEB
GetProcAddress.KERNEL32 ref: 00007FFDFABD7C00
PyErr_Format.PYTHON313 ref: 00007FFDFABD7C2C
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD7C49
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD7C71
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABD7CE2
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD7CF0
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD7D05
PyDict_GetItem.PYTHON313 ref: 00007FFDFABD7D25
_Py_Dealloc.PYTHON313 ref: 00007FFDFABD7D3B
PyErr_Clear.PYTHON313 ref: 00007FFDFABD7D46
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABD7D5F
PyErr_SetString.PYTHON313 ref: 00007FFDFABD7D8F
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD7D95
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD7DAA

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABD7D7E
Not available on this platform, xrefs: 00007FFDFABD7C22
oleacc.dll, xrefs: 00007FFDFABD7BE4
ObjectFromLresult, xrefs: 00007FFDFABD7BF6
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABD7D69
There is no interface object registered that supports this IID, xrefs: 00007FFDFABD7D4C
OOO, xrefs: 00007FFDFABD7B79

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$U_object@@$Err_Object_$Dealloc$D@@@FromLong_Ptr@@Void$AddressArg_BuildClearDict_ErrorFormatInfoItemLibraryLoadObjectParseProcStringSubclassTupleValue
String ID: Not available on this platform$OOO$ObjectFromLresult$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$oleacc.dll
API String ID: 2496039126-61211265
Opcode ID: 1e78c53d427ea94a9f324b1635429e505fbdaa07bb74185ed0fb6898ffe3e7c7
Instruction ID: ec3e4ae7ff4005b7dc808950d08ff0d4ff417992957bc42da4185f5abcef4b94
Opcode Fuzzy Hash: 1e78c53d427ea94a9f324b1635429e505fbdaa07bb74185ed0fb6898ffe3e7c7
Instruction Fuzzy Hash: F2713B29B08B4295FB589B15E864ABD63B1FF88B84F8444B5D96E8779CEF3CE045C300

Function 00007FFDFABD4B80 Relevance: 70.2, APIs: 31, Strings: 9, Instructions: 250threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABD4BAF
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABD4BC3
PyErr_SetString.PYTHON313 ref: 00007FFDFABD4BF3
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABD4C22
PyErr_Occurred.PYTHON313 ref: 00007FFDFABD4C37
PyErr_SetString.PYTHON313 ref: 00007FFDFABD4C53
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABD4C7C
PyErr_Format.PYTHON313 ref: 00007FFDFABD4C9F
PyErr_SetString.PYTHON313 ref: 00007FFDFABD4CC3
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD4CD0
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD4CF3
PyObject_GetAttrString.PYTHON313 ref: 00007FFDFABD4D28
PyErr_Clear.PYTHON313 ref: 00007FFDFABD4D36
PyErr_SetString.PYTHON313 ref: 00007FFDFABD4D64
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABD4D7B
PyErr_Format.PYTHON313 ref: 00007FFDFABD4D9E
_Py_Dealloc.PYTHON313 ref: 00007FFDFABD4E2C
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD4E3F
CoMarshalInterThreadInterfaceInStream.OLE32 ref: 00007FFDFABD4E57
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD4E6D
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABD4EC0
PyDict_GetItem.PYTHON313 ref: 00007FFDFABD4ED8
_Py_Dealloc.PYTHON313 ref: 00007FFDFABD4EEF
PyErr_Clear.PYTHON313 ref: 00007FFDFABD4EFA
PyErr_SetString.PYTHON313 ref: 00007FFDFABD4F11
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD4F17
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD4F2C
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABD4F44

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABD4F63
_oleobj_, xrefs: 00007FFDFABD4D1E
The Python object is NULL and no error occurred, xrefs: 00007FFDFABD4C42
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABD4F4E
The Python instance can not be converted to a COM object, xrefs: 00007FFDFABD4D3C
argument is not a COM object (got type=%s), xrefs: 00007FFDFABD4C8A, 00007FFDFABD4D89
None is not a valid interface object in this context, xrefs: 00007FFDFABD4BDD, 00007FFDFABD4C69, 00007FFDFABD4D5A
OO:CoMarshalInterThreadInterfaceInStream, xrefs: 00007FFDFABD4BA3
There is no interface object registered that supports this IID, xrefs: 00007FFDFABD4F00

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$Object_Thread$Eval_String$InstanceRestoreSave$ClearD@@@DeallocFormatU_object@@$Arg_AttrDict_FromInterInterfaceItemMarshalOccurredParseStreamSubclassTuple
String ID: None is not a valid interface object in this context$OO:CoMarshalInterThreadInterfaceInStream$The Python IID map is invalid - the value is not an interface type object$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$_oleobj_$argument is not a COM object (got type=%s)
API String ID: 3258495939-3992131260
Opcode ID: 1193b0936db64b6e7d189aa776db46e56148a5099947978452992733660ef2b3
Instruction ID: ebaf8ea76be1a45bb2a4bd86227741f49f0feb564aa1a27fb65cc0026f49443b
Opcode Fuzzy Hash: 1193b0936db64b6e7d189aa776db46e56148a5099947978452992733660ef2b3
Instruction Fuzzy Hash: 40C10B29B08A4392FB199B55E86497D63A1FF89B84F8440B2DA6E477ECDF7CE405C340

Function 00007FFDFABC3970 Relevance: 70.2, APIs: 33, Strings: 7, Instructions: 210memoryCOMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC399E
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC39C3
SysAllocString.OLEAUT32 ref: 00007FFDFABC39D4
PyErr_Clear.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC39EB
_Py_Dealloc.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3A04
PyObject_GetAttrString.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3A14
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3A39
SysAllocString.OLEAUT32 ref: 00007FFDFABC3A4A
PyErr_Clear.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3A61
_Py_Dealloc.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3A7A
PyObject_GetAttrString.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3A8A
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3AAF
SysAllocString.OLEAUT32 ref: 00007FFDFABC3AC0
PyErr_Clear.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3AD7
_Py_Dealloc.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3AF0
PyObject_GetAttrString.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3B05
PyNumber_Long.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3B1F
PyLong_AsLong.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3B30
_Py_Dealloc.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3B47
PyErr_Clear.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3B4F
_Py_Dealloc.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3B68
PyObject_GetAttrString.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3B78
PyNumber_Long.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3B92
PyLong_AsLong.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3BA3
_Py_Dealloc.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3BBA
PyErr_Clear.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3BCB
_Py_Dealloc.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3BE4
PyObject_GetAttrString.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3BF4
PyNumber_Long.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3C13
PyLong_AsLong.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3C24
_Py_Dealloc.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3C3E
PyErr_Clear.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3C46
_Py_Dealloc.PYTHON313(?,?,?,00007FFDFABC3ED0,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3C5F

Strings

source, xrefs: 00007FFDFABC3A0A
description, xrefs: 00007FFDFABC3997
helpfile, xrefs: 00007FFDFABC3A80
helpcontext, xrefs: 00007FFDFABC3BEA
code, xrefs: 00007FFDFABC3AF6
scode, xrefs: 00007FFDFABC3B6E
<Bad String Object>, xrefs: 00007FFDFABC39CD, 00007FFDFABC3A43, 00007FFDFABC3AB9

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: DeallocObject_String$AttrClearErr_Long$AllocBstr@@Long_Number_U_object@@
String ID: <Bad String Object>$code$description$helpcontext$helpfile$scode$source
API String ID: 3990970108-1363959443
Opcode ID: 547d23819fc1a0aa53f1cfedbc9f42698f8de3fac7649c6d29310ef7cd265693
Instruction ID: 178b735123a320eabccb70394be115aa2abaf862be68babacf0c6b0a43ac4a70
Opcode Fuzzy Hash: 547d23819fc1a0aa53f1cfedbc9f42698f8de3fac7649c6d29310ef7cd265693
Instruction Fuzzy Hash: 0FA10835F09B4392FB5C9B25A864E7CA3E0EF45B44F8954B5DA6E426D8EF2DE490C300

Function 00007FFDFABEAEB0 Relevance: 68.5, APIs: 29, Strings: 10, Instructions: 278threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABEAF2B
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABEAF48
PyErr_Occurred.PYTHON313 ref: 00007FFDFABEAF5D
PyErr_SetString.PYTHON313 ref: 00007FFDFABEAF79
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABEAFA2
PyErr_Format.PYTHON313 ref: 00007FFDFABEAFC5
PyErr_SetString.PYTHON313 ref: 00007FFDFABEAFE9
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABEAFF6
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABEB019
PyObject_GetAttrString.PYTHON313 ref: 00007FFDFABEB04E
PyErr_Clear.PYTHON313 ref: 00007FFDFABEB05C
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABEB15A
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABEB18D
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABEB1ED
PyDict_GetItem.PYTHON313 ref: 00007FFDFABEB205
_Py_Dealloc.PYTHON313 ref: 00007FFDFABEB21C
PyErr_Clear.PYTHON313 ref: 00007FFDFABEB227
PyErr_SetString.PYTHON313 ref: 00007FFDFABEB23E
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABEB244
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABEB259
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABEB277

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABEB296
_oleobj_, xrefs: 00007FFDFABEB044
The Python object is NULL and no error occurred, xrefs: 00007FFDFABEAF68
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABEB281
The Python instance can not be converted to a COM object, xrefs: 00007FFDFABEB062
argument is not a COM object (got type=%s), xrefs: 00007FFDFABEAFB0, 00007FFDFABEB0AF
None is not a valid interface object in this context, xrefs: 00007FFDFABEAF15, 00007FFDFABEAF8F, 00007FFDFABEB080
O:CopyProxy, xrefs: 00007FFDFABEAEF4
There is no interface object registered that supports this IID, xrefs: 00007FFDFABEB22D
The Python object is invalid, xrefs: 00007FFDFABEAECA

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$Eval_Thread$Object_String$RestoreSave$ClearInstance$AttrD@@@DeallocDict_FormatFromItemOccurredSubclassU_object@@
String ID: None is not a valid interface object in this context$O:CopyProxy$The Python IID map is invalid - the value is not an interface type object$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$_oleobj_$argument is not a COM object (got type=%s)
API String ID: 1654362002-3565943136
Opcode ID: 8d22f7fb159bce3b4db57e3c1f03d516569801a1ae53dc8e0e64ea5bbc511839
Instruction ID: 2e35a174d1b7a000689b5741b877f6d9fb85bf7037b4fdc535c96e2216808b43
Opcode Fuzzy Hash: 8d22f7fb159bce3b4db57e3c1f03d516569801a1ae53dc8e0e64ea5bbc511839
Instruction Fuzzy Hash: 55C14D69B09A0291FB199B55E8B097C23A1FF84B95F8484B2CD2D473ECDE7CE845C341

Function 00007FFDFABD5E60 Relevance: 63.2, APIs: 29, Strings: 7, Instructions: 247threadcomCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABD5E9D
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABD5EB1
PyErr_Occurred.PYTHON313 ref: 00007FFDFABD5EC5
PyErr_SetString.PYTHON313 ref: 00007FFDFABD5EE1
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABD5F0A
PyErr_Format.PYTHON313 ref: 00007FFDFABD5F2D
PyErr_SetString.PYTHON313 ref: 00007FFDFABD5F51
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD5F5E
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD5F81
PyErr_Occurred.PYTHON313 ref: 00007FFDFABD5FB4
PyErr_SetString.PYTHON313 ref: 00007FFDFABD5FD4
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD5FFD
OleLoad.OLE32 ref: 00007FFDFABD601A
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD603B
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABD6089
PyErr_Format.PYTHON313 ref: 00007FFDFABD60AC
PyErr_SetString.PYTHON313 ref: 00007FFDFABD60D8
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD60F0
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD6113
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABD6175
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD6183
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD6198
PyDict_GetItem.PYTHON313 ref: 00007FFDFABD61B8
_Py_Dealloc.PYTHON313 ref: 00007FFDFABD61CE
PyErr_Clear.PYTHON313 ref: 00007FFDFABD61D9
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABD61F2
PyErr_SetString.PYTHON313 ref: 00007FFDFABD6222
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD6228
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD623D

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABD6211
The Python object is NULL and no error occurred, xrefs: 00007FFDFABD5ED0, 00007FFDFABD5FCA
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABD61FC
argument is not a COM object (got type=%s), xrefs: 00007FFDFABD5F18, 00007FFDFABD6097
None is not a valid interface object in this context, xrefs: 00007FFDFABD5EF7
There is no interface object registered that supports this IID, xrefs: 00007FFDFABD61DF
OOO:OleLoad, xrefs: 00007FFDFABD5E96

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_Eval_Thread$Object_RestoreSaveString$D@@@FormatInstanceOccurredU_object@@$Arg_ClearDeallocDict_FromItemLoadParseSubclassTuple
String ID: None is not a valid interface object in this context$OOO:OleLoad$The Python IID map is invalid - the value is not an interface type object$The Python object is NULL and no error occurred$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$argument is not a COM object (got type=%s)
API String ID: 3610570848-1529046959
Opcode ID: 12dee3cfcbc85b15800122a5c6d446d02268fd2ed17555d0ecdcf2143fbb1417
Instruction ID: 8eecfb7443eb86052a069efac16773808012108ddb20eeeafa37b59c17b5af64
Opcode Fuzzy Hash: 12dee3cfcbc85b15800122a5c6d446d02268fd2ed17555d0ecdcf2143fbb1417
Instruction Fuzzy Hash: D6C1FD29B18A4291FB189B15E874A7D63A0FF88F84F4454B6DD6E8779CDE3CE445C340

Function 00007FFDFABCE940 Relevance: 52.8, APIs: 27, Strings: 3, Instructions: 282threadstringCOMMON

Download Yara Rule

APIs

PyUnicode_AsUTF8.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCE963
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCE97C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCE9C3
PyErr_NoMemory.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCE9D1
PyObject_GenericGetAttr.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCEA99
PyErr_Clear.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCEAA8
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCEABB
VariantInit.OLEAUT32 ref: 00007FFDFABCEAC9
PyEval_SaveThread.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCEAD6
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCEB05
PyEval_RestoreThread.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCEB0E
PyErr_SetObject.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCEB2D
SafeArrayGetDim.OLEAUT32 ref: 00007FFDFABCEBAF
PyErr_Format.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCEBCC
SafeArrayGetDim.OLEAUT32 ref: 00007FFDFABCEBDA
PyErr_Format.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCEBF6
SafeArrayGetUBound.OLEAUT32 ref: 00007FFDFABCEC15
SafeArrayGetLBound.OLEAUT32 ref: 00007FFDFABCEC32
SafeArrayGetRecordInfo.OLEAUT32 ref: 00007FFDFABCEC4A
PyTuple_New.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCEC85
_Py_NewReference.PYTHON313(?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00007FFDFABCE756), ref: 00007FFDFABCECD7

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

Strings

Did not get a buffer for the array!, xrefs: 00007FFDFABCEBBB
__members__, xrefs: 00007FFDFABCE972
Only support single dimensional arrays of records, xrefs: 00007FFDFABCEBE5

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_$ArraySafe$Object_RestoreSave$BoundDeallocFormatInfoObjectU_object@@$AttrBuildClearErrorFreeFromGenericInitMemoryRecordReferenceTuple_Unicode_ValueVariantmallocstrcmp
String ID: Did not get a buffer for the array!$Only support single dimensional arrays of records$__members__
API String ID: 1698912420-4199362239
Opcode ID: 74414800d0552f0531fc93be48073f0755b19a1763c29ce602da499a02820b2a
Instruction ID: ff91bea1bbdb91bb327d8080b75420f6ac44a15a9a5b0621d74f9ce642581bea
Opcode Fuzzy Hash: 74414800d0552f0531fc93be48073f0755b19a1763c29ce602da499a02820b2a
Instruction Fuzzy Hash: 17C1402AB05A42D6EB189F25D864EBD23A0FF48B94B954475DE2EA37D8DF3DE405C300

Function 00007FFDFAC0AC40 Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 215COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC0AC64
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0AC91

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFAC0AF6D
The Python object is NULL and no error occurred, xrefs: 00007FFDFAC0AD44
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFAC0AF58
OOi|zi:OpenStorage, xrefs: 00007FFDFAC0ACE3
argument is not a COM object (got type=%s), xrefs: 00007FFDFAC0AE13
There is no interface object registered that supports this IID, xrefs: 00007FFDFAC0AF2B
The Python object is invalid, xrefs: 00007FFDFAC0AC56

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: OOi|zi:OpenStorage$The Python IID map is invalid - the value is not an interface type object$The Python object is NULL and no error occurred$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$argument is not a COM object (got type=%s)
API String ID: 1450464846-990463234
Opcode ID: 516f2642505758276980b966bd65e5477f52ac2666b88697fade553129743350
Instruction ID: 9432f570cd7be3f94214f73eb38a75a135a5cd026cc1fdb950664100188380ed
Opcode Fuzzy Hash: 516f2642505758276980b966bd65e5477f52ac2666b88697fade553129743350
Instruction Fuzzy Hash: 80A16C6AB19A5295FB589B15E860BBD63B0FF44B85F0880B2DD6D836D8DF3CE445C300

Function 00007FFDFAC18904 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 243COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC1897C
PyLong_AsVoidPtr.PYTHON313 ref: 00007FFDFAC1898E
PyTuple_Size.PYTHON313 ref: 00007FFDFAC18A0D
PyTuple_Size.PYTHON313 ref: 00007FFDFAC18A2A
PyErr_Format.PYTHON313 ref: 00007FFDFAC18A4B
PyLong_AsLong.PYTHON313 ref: 00007FFDFAC18AB8
PyLong_AsLong.PYTHON313 ref: 00007FFDFAC18ACE
SafeArrayCreate.OLEAUT32 ref: 00007FFDFAC18B46
SysStringLen.OLEAUT32 ref: 00007FFDFAC18B7B
PyObject_Str.PYTHON313 ref: 00007FFDFAC18B97
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFAC18BB6
SysStringLen.OLEAUT32 ref: 00007FFDFAC18BC8
SysFreeString.OLEAUT32 ref: 00007FFDFAC18BF7
PyNumber_Long.PYTHON313 ref: 00007FFDFAC18C08
PyLong_AsLong.PYTHON313 ref: 00007FFDFAC18C1D
PyErr_Occurred.PYTHON313 ref: 00007FFDFAC18D20
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC18F15
PyErr_SetString.PYTHON313 ref: 00007FFDFAC19395
PyErr_Format.PYTHON313 ref: 00007FFDFAC193B7
PyErr_Format.PYTHON313 ref: 00007FFDFAC193F1

Strings

The VARIANT type is unknown (0x%x)., xrefs: 00007FFDFAC193E7
Return value[%d] with type BSTR was longer than the input value: %d, xrefs: 00007FFDFAC193A7
Expecting a tuple of length %d or None., xrefs: 00007FFDFAC18A3E
Inplace SAFEARRAY mucking isn't allowed, doh!, xrefs: 00007FFDFAC19384
OLE type description - expecting a tuple, xrefs: 00007FFDFAC189FE
OOO:WriteFromOutTuple, xrefs: 00007FFDFAC18975

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$LongLong_String$Format$Object_SizeTuple_$Arg_ArrayBstr@@CreateDeallocFreeNumber_OccurredParseSafeTupleU_object@@Void
String ID: Expecting a tuple of length %d or None.$Inplace SAFEARRAY mucking isn't allowed, doh!$OLE type description - expecting a tuple$OOO:WriteFromOutTuple$Return value[%d] with type BSTR was longer than the input value: %d$The VARIANT type is unknown (0x%x).
API String ID: 544121207-2746864272
Opcode ID: 88b8d70bfb7888c05bc5cabf091e763b890ed64f927bf44300bb156e3ba1c392
Instruction ID: bfe8fda3128e6b65e8c5e348902fe46a76fa071fa7914f009c49e314d51b92e3
Opcode Fuzzy Hash: 88b8d70bfb7888c05bc5cabf091e763b890ed64f927bf44300bb156e3ba1c392
Instruction Fuzzy Hash: 80B14F3AB0CA4296FB188B19D464ABD63A1FF49B84F5444B1CA6E977D8DE3CF456C300

Function 00007FFDFABC7EB0 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABC7ECB
PyTuple_New.PYTHON313 ref: 00007FFDFABC7ED8
PyErr_Clear.PYTHON313 ref: 00007FFDFABC7EE6
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC7F07
PyTuple_SetItem.PYTHON313 ref: 00007FFDFABC7F1E
PyLong_FromDouble.PYTHON313 ref: 00007FFDFABC7F48
PyErr_Clear.PYTHON313 ref: 00007FFDFABC7F56
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC7F71
PyGILState_Release.PYTHON313 ref: 00007FFDFABC80D7
PyErr_Clear.PYTHON313 ref: 00007FFDFABC80F2
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC8106

Strings

_GetIDsOfNames_, xrefs: 00007FFDFABC7FDA

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: ClearErr_$DeallocFromState_Tuple_$DoubleEnsureItemLong_Object_ReleaseU_object@@
String ID: _GetIDsOfNames_
API String ID: 3766188944-521210149
Opcode ID: af0fd0ad0f398063c6733c4c342adb8fe568e439a4fb4aed1009be436449a6ff
Instruction ID: 7521e741d9d9cabeb9005cd1764078d7e39c8d2cf9839e6736ad804c39e772a5
Opcode Fuzzy Hash: af0fd0ad0f398063c6733c4c342adb8fe568e439a4fb4aed1009be436449a6ff
Instruction Fuzzy Hash: 64615935B08A43A2FB189F65A8A4D3C63E1BF44B50F4545B5DAAE826D8DF3CB485C701

Function 00007FFDFAC14BD0 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 211COMMON

Download Yara Rule

APIs

PyObject_Size.PYTHON313 ref: 00007FFDFAC14C11
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC14C22
PyErr_SetObject.PYTHON313 ref: 00007FFDFAC14C3D
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC14C51
??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z.PYWINTYPES313 ref: 00007FFDFAC14C97
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC14CB1
PyErr_SetObject.PYTHON313 ref: 00007FFDFAC14CCC
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC14CE0
??1PyWinBufferView@@QEAA@XZ.PYWINTYPES313 ref: 00007FFDFAC14CED
SafeArrayAccessData.OLEAUT32 ref: 00007FFDFAC14D02
memcpy.VCRUNTIME140 ref: 00007FFDFAC14D2A
SafeArrayUnaccessData.OLEAUT32 ref: 00007FFDFAC14D32
PySequence_GetItem.PYTHON313 ref: 00007FFDFAC14D6A
SafeArrayPutElement.OLEAUT32 ref: 00007FFDFAC14E0E
VariantClear.OLEAUT32 ref: 00007FFDFAC14E1B
PyErr_SetString.PYTHON313 ref: 00007FFDFAC14E33
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC14E4D
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC14E88
PyErr_SetObject.PYTHON313 ref: 00007FFDFAC14EA3
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC14EB7

Strings

All dimensions must be a sequence of the same size, xrefs: 00007FFDFAC14C1B
Could not set the SAFEARRAY element, xrefs: 00007FFDFAC14E25
Internal error - unexpected argument - only simple VARIANTTYPE expected, xrefs: 00007FFDFAC14E81
Internal error - the buffer length is not the sequence length!, xrefs: 00007FFDFAC14CAA

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: DeallocErr_Object_$ArrayFromObjectSafeU_object@@$BufferDataView@@$AccessClearElementItemSequence_SizeStringU_object@@_UnaccessVariantmemcpy
String ID: All dimensions must be a sequence of the same size$Could not set the SAFEARRAY element$Internal error - the buffer length is not the sequence length!$Internal error - unexpected argument - only simple VARIANTTYPE expected
API String ID: 2035938186-1356164553
Opcode ID: 5d86637ab1c27fdb75c306f7bc571d7cf0912799a1ea50d32d3adb8be529ada7
Instruction ID: 3c41aadd719956c0ae61c7fdce96a8aa9d81181abeac94955438da60ae92dc40
Opcode Fuzzy Hash: 5d86637ab1c27fdb75c306f7bc571d7cf0912799a1ea50d32d3adb8be529ada7
Instruction Fuzzy Hash: 13915C7AB08A02A5FB19DF25D964ABD63A1FF48B84F5440B1DA2E56ADCDF3CE445C300

Function 00007FFDFABD0C00 Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 209threadlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFDFABD0C56
GetProcAddress.KERNEL32 ref: 00007FFDFABD0C7B
PyErr_Format.PYTHON313 ref: 00007FFDFABD0CAD
PyArg_ParseTupleAndKeywords.PYTHON313 ref: 00007FFDFABD0D34
?PyWinObject_AsSECURITY_DESCRIPTOR@@YAHPEAU_object@@PEAPEAXH@Z.PYWINTYPES313 ref: 00007FFDFABD0D4E
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFABD0D6B
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD0DB6
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD0DFD
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABD0E5C
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD0E6A
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD0E7F
PyDict_GetItem.PYTHON313 ref: 00007FFDFABD0E94
_Py_Dealloc.PYTHON313 ref: 00007FFDFABD0EAB
PyErr_Clear.PYTHON313 ref: 00007FFDFABD0EB6
PyErr_SetString.PYTHON313 ref: 00007FFDFABD0ECD
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABD0EDF
PyMem_Free.PYTHON313 ref: 00007FFDFABD0F34

Strings

OiiiO&|OO:StgCreateStorageEx, xrefs: 00007FFDFABD0D27
The type does not declare a PyCom constructor, xrefs: 00007FFDFABD0EFE
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABD0EE9
StgCreateStorageEx not supported by this version of Windows, xrefs: 00007FFDFABD0C9C
StgCreateStorageEx, xrefs: 00007FFDFABD0C71
Ole32.dll, xrefs: 00007FFDFABD0C4F
There is no interface object registered that supports this IID, xrefs: 00007FFDFABD0EBC

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Object_Thread$Err_U_object@@$RestoreSave$AddressArg_ClearD@@@DeallocDict_FormatFreeFromHandleItemKeywordsMem_ModuleParseProcStringSubclassTuple
String ID: OiiiO&|OO:StgCreateStorageEx$Ole32.dll$StgCreateStorageEx$StgCreateStorageEx not supported by this version of Windows$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 3081650828-3294452327
Opcode ID: 9980cae1a35e21c361899850085f151c8e0b0ee5ab2b9ad67d5ba49a52ab2280
Instruction ID: 05a8089634f6c3dc221ab54ea8e819e9fa48f4ad4989e6bda44e95766d1c0497
Opcode Fuzzy Hash: 9980cae1a35e21c361899850085f151c8e0b0ee5ab2b9ad67d5ba49a52ab2280
Instruction Fuzzy Hash: 82A10839B09A029AFB18DB61E860ABD33A1FB48B94B844575DE6E537D8DF3CE505C340

Function 00007FFDFABF4C10 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 202threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABF4C34
PyErr_SetString.PYTHON313 ref: 00007FFDFABF4C51
memset.VCRUNTIME140 ref: 00007FFDFABF4CAD
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF4CB8
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF4CDC
PyTuple_New.PYTHON313 ref: 00007FFDFABF4D24
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABF4D94
PyDict_GetItem.PYTHON313 ref: 00007FFDFABF4DB0
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF4DC7
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABF4DE0
PyErr_SetString.PYTHON313 ref: 00007FFDFABF4E32
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF4E38
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF4E4D
PyErr_Clear.PYTHON313 ref: 00007FFDFABF4E60
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF4E6F
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF4E84
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF4E9C
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF4ECF
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF4EE4

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABF4E21
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABF4E57
|l:Next, xrefs: 00007FFDFABF4C2D
There is no interface object registered that supports this IID, xrefs: 00007FFDFABF4E66
The Python object is invalid, xrefs: 00007FFDFABF4C43

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Err_$DeallocObject_String$Arg_ClearD@@@Dict_FromItemParseSubclassTupleTuple_U_object@@memset
String ID: The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$|l:Next
API String ID: 3151522385-2073613222
Opcode ID: bebb7688d6dc27682f3902723d951c9af90bda6cbca9bf086570401e56dcf950
Instruction ID: 21995c8943920bcd9420a7c9e2fb6d94b8640b1759b61c3d7d468c28f720b0dc
Opcode Fuzzy Hash: bebb7688d6dc27682f3902723d951c9af90bda6cbca9bf086570401e56dcf950
Instruction Fuzzy Hash: 1D913939B19B4282EB1C9F66A824A7963A1FF84B80F8844B5DE6D477DCDF3CE4558700

Function 00007FFDFABF5920 Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 203threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABF5943
PyErr_SetString.PYTHON313 ref: 00007FFDFABF5960
memset.VCRUNTIME140 ref: 00007FFDFABF59BB
PyTuple_New.PYTHON313 ref: 00007FFDFABF5A23
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABF5A9B
PyDict_GetItem.PYTHON313 ref: 00007FFDFABF5AB7
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF5ACE
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABF5AE7
Py_BuildValue.PYTHON313 ref: 00007FFDFABF5B2C
PyErr_SetString.PYTHON313 ref: 00007FFDFABF5B54
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF5B5A
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF5B6F
PyErr_Clear.PYTHON313 ref: 00007FFDFABF5B82
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF5B91
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF5BA6
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF5BC0
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF5BFC
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF5C11

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABF5B43
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABF5B79
|l:Next, xrefs: 00007FFDFABF593C
There is no interface object registered that supports this IID, xrefs: 00007FFDFABF5B88
The Python object is invalid, xrefs: 00007FFDFABF5952

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSave$DeallocObject_String$Arg_BuildClearD@@@Dict_FromItemParseSubclassTupleTuple_U_object@@Valuememset
String ID: The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$|l:Next
API String ID: 365869195-2073613222
Opcode ID: 4c8f11d957bf2d64f27996bf45678c62509854947ebaab039fafda7de43bd1a0
Instruction ID: 059f06813ccd9e8e71401f321855643c18e13173d0cf792bf2f7690a6e186f9e
Opcode Fuzzy Hash: 4c8f11d957bf2d64f27996bf45678c62509854947ebaab039fafda7de43bd1a0
Instruction Fuzzy Hash: 53915A69B08B8282EB189F55E864A7D63A5FF44B80F8845B1DA6E477D8DF3CE055C700

Function 00007FFDFABD08D0 Relevance: 40.4, APIs: 16, Strings: 7, Instructions: 198threadlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFDFABD0926
GetProcAddress.KERNEL32 ref: 00007FFDFABD094B
PyErr_Format.PYTHON313 ref: 00007FFDFABD097D
PyArg_ParseTupleAndKeywords.PYTHON313 ref: 00007FFDFABD09F3
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFABD0A0F
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD0A5A
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD0A9D
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABD0AFC
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD0B0A
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD0B1F
PyDict_GetItem.PYTHON313 ref: 00007FFDFABD0B34
_Py_Dealloc.PYTHON313 ref: 00007FFDFABD0B4B
PyErr_Clear.PYTHON313 ref: 00007FFDFABD0B56
PyErr_SetString.PYTHON313 ref: 00007FFDFABD0B6D
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABD0B7F
PyMem_Free.PYTHON313 ref: 00007FFDFABD0BD4

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABD0B9E
OiiiO&|O:StgOpenStorageEx, xrefs: 00007FFDFABD09E6
StgOpenStorageEx not supported by this version of Windows, xrefs: 00007FFDFABD096C
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABD0B89
StgOpenStorageEx, xrefs: 00007FFDFABD0941
Ole32.dll, xrefs: 00007FFDFABD091F
There is no interface object registered that supports this IID, xrefs: 00007FFDFABD0B5C

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_Object_$RestoreSaveU_object@@$AddressArg_ClearD@@@DeallocDict_FormatFreeFromHandleItemKeywordsMem_ModuleParseProcStringSubclassTuple
String ID: OiiiO&|O:StgOpenStorageEx$Ole32.dll$StgOpenStorageEx$StgOpenStorageEx not supported by this version of Windows$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1531689404-2224397758
Opcode ID: 8e0d85b12df33b9e38501e22eb155c57a48eccc4e7e82178f20167b50863586b
Instruction ID: 5a1748834893901203fc4a7e74ec203dd06fd9e94f872660db9a1be02d15b45b
Opcode Fuzzy Hash: 8e0d85b12df33b9e38501e22eb155c57a48eccc4e7e82178f20167b50863586b
Instruction Fuzzy Hash: 15A10629B09B4295FB18CB65E860ABD23A0EB48B98B8445B5DD6E537ECDF3CE505C340

Function 00007FFDFAC18F20 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC18F4A
PyObject_IsInstance.PYTHON313 ref: 00007FFDFAC18F6E
PyErr_Occurred.PYTHON313 ref: 00007FFDFAC18F81
PyErr_SetString.PYTHON313 ref: 00007FFDFAC18F9D
PyObject_IsInstance.PYTHON313 ref: 00007FFDFAC18FCE
PyErr_Format.PYTHON313 ref: 00007FFDFAC18FF1

Strings

_oleobj_, xrefs: 00007FFDFAC1906B
The Python object is NULL and no error occurred, xrefs: 00007FFDFAC18F93
The Python instance can not be converted to a COM object, xrefs: 00007FFDFAC193D7
argument is not a COM object (got type=%s), xrefs: 00007FFDFAC18FDC, 00007FFDFAC190AC

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_Object_$Instance$D@@@FormatOccurredStringU_object@@
String ID: The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$_oleobj_$argument is not a COM object (got type=%s)
API String ID: 4199324350-136146293
Opcode ID: d1e300911af3e15d37a783297b14a86fd4eed4f1a4c7167291a456ca0fcb0517
Instruction ID: 88eed02b12a913317881eac7abe906013f9dfee393f9c34d9c6913879b6fe835
Opcode Fuzzy Hash: d1e300911af3e15d37a783297b14a86fd4eed4f1a4c7167291a456ca0fcb0517
Instruction Fuzzy Hash: 1981092DB08A43E5FB589B65D8B4A7C23A1FF48B88F4444B6CA2E477D8DE6CE445C340

Function 00007FFDFABC4870 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABC48A6
PyErr_Fetch.PYTHON313 ref: 00007FFDFABC48D8

Part of subcall function 00007FFDFABC1D20: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFABC1D63

PyObject_CallMethod.PYTHON313 ref: 00007FFDFABC490C
PyErr_Clear.PYTHON313 ref: 00007FFDFABC491A
PyImport_ImportModule.PYTHON313 ref: 00007FFDFABC4927
PyObject_GetAttrString.PYTHON313 ref: 00007FFDFABC493F
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC4956
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC4973
PyErr_Restore.PYTHON313 ref: 00007FFDFABC498B
PyErr_Restore.PYTHON313 ref: 00007FFDFABC49A2
__stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDFABC4A00
PyErr_Fetch.PYTHON313 ref: 00007FFDFABC4A3C
PyErr_NormalizeException.PYTHON313 ref: 00007FFDFABC4A5B
?GetPythonTraceback@@YAPEA_WPEAU_object@@00@Z.PYWINTYPES313 ref: 00007FFDFABC4A7C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFABC4A90
PyErr_Restore.PYTHON313 ref: 00007FFDFABC4AA5
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC4ABE
PyGILState_Release.PYTHON313 ref: 00007FFDFABC4AC7

Strings

logger, xrefs: 00007FFDFABC4935
_GetLogger_, xrefs: 00007FFDFABC4902
pythoncom %hs: , xrefs: 00007FFDFABC48E4
win32com, xrefs: 00007FFDFABC4920

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$DeallocRestore$FetchObject_State___stdio_common_vswprintf$AttrCallClearEnsureExceptionImportImport_MethodModuleNormalizePythonReleaseStringTraceback@@U_object@@00@free
String ID: _GetLogger_$logger$pythoncom %hs: $win32com
API String ID: 1729153949-4284417512
Opcode ID: 8f497a61296da6ed75c4f8688cd41eb60f8be8e53836b21e125204271b273203
Instruction ID: 7bd425361ba6b0353e1dc38550cf2784250aa50d279ac4c0717027541b1d0777
Opcode Fuzzy Hash: 8f497a61296da6ed75c4f8688cd41eb60f8be8e53836b21e125204271b273203
Instruction Fuzzy Hash: 10614036B18A4291EB489B11F964DBEA3A0FF84B99F444072EE6E436ACDF7CD545C700

Function 00007FFDFABFDBF0 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 182threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABFDC14
PyErr_SetString.PYTHON313 ref: 00007FFDFABFDC31
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABFDC7A
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABFDC9E
PyTuple_New.PYTHON313 ref: 00007FFDFABFDCDA
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABFDD50
PyDict_GetItem.PYTHON313 ref: 00007FFDFABFDD6C
_Py_Dealloc.PYTHON313 ref: 00007FFDFABFDD83
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABFDD98
PyErr_SetString.PYTHON313 ref: 00007FFDFABFDE01
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABFDE07
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABFDE1C
_Py_Dealloc.PYTHON313 ref: 00007FFDFABFDE38
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABFDE70
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABFDE85

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABFDDD8
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABFDDE1
|l:Next, xrefs: 00007FFDFABFDC0D
There is no interface object registered that supports this IID, xrefs: 00007FFDFABFDDF0
The Python object is invalid, xrefs: 00007FFDFABFDC23

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocErr_Object_String$Arg_D@@@Dict_FromItemParseSubclassTupleTuple_U_object@@
String ID: The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$|l:Next
API String ID: 3180337578-2073613222
Opcode ID: c9cfcb2e2c0d5648c2eca6d6940e6b53dc2f1fea530b844ac6293f89a2a20262
Instruction ID: e697bb592f6e90fab3d21a002bbaf2e2fc57e0adb6dfd9730c2984802dc5bb65
Opcode Fuzzy Hash: c9cfcb2e2c0d5648c2eca6d6940e6b53dc2f1fea530b844ac6293f89a2a20262
Instruction Fuzzy Hash: 01815839B09B4282EB189B55A824A7D63A0FF85B98F8840B5DE6D477ECDF3CE455C340

Function 00007FFDFABF5F40 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 176threadCOMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABF5F6C
PySequence_Check.PYTHON313 ref: 00007FFDFABF5FAD
PyObject_Size.PYTHON313 ref: 00007FFDFABF5FC0
PySequence_GetItem.PYTHON313 ref: 00007FFDFABF6008
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABF6031
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF606F
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF6090
PyErr_SetString.PYTHON313 ref: 00007FFDFABF60BA
PyErr_Occurred.PYTHON313 ref: 00007FFDFABF60D8
PyErr_Clear.PYTHON313 ref: 00007FFDFABF610B
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF6121
CreateErrorInfo.OLEAUT32 ref: 00007FFDFABF612C
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF6157
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF617C
SetErrorInfo.OLEAUT32 ref: 00007FFDFABF618D
PyGILState_Release.PYTHON313 ref: 00007FFDFABF61B3

Strings

Unexpected exception in gateway method '%hs', xrefs: 00007FFDFABF60F0
<unknown>, xrefs: 00007FFDFABF60E7
result must be a tuple of (PyIUnknown, dwCookie), xrefs: 00007FFDFABF60B0
Next, xrefs: 00007FFDFABF5F88

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: DeallocErr_$ErrorEval_InfoSequence_State_Thread$Arg_CheckClearCreateEnsureItemObject_OccurredParseReleaseRestoreSaveSizeStringTuple
String ID: <unknown>$Next$Unexpected exception in gateway method '%hs'$result must be a tuple of (PyIUnknown, dwCookie)
API String ID: 2850218688-1562171100
Opcode ID: d47ea48f32d76c1bbe03f9a12d67ecc221deb444d37432f1b743e90926e8d0f3
Instruction ID: a030bc5e2e11254f5deb905d623b1dce7a0b27c4d69206483ec7398758e08d8f
Opcode Fuzzy Hash: d47ea48f32d76c1bbe03f9a12d67ecc221deb444d37432f1b743e90926e8d0f3
Instruction Fuzzy Hash: F1719036B18A8692EB089B65E87497D63A0FF84F95F945071DE2E877E8DE3CE405C300

Function 00007FFDFABE5BA0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABE5BE0
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABE5BF9
PyDict_GetItem.PYTHON313 ref: 00007FFDFABE5C15
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE5C2C
PyErr_Clear.PYTHON313 ref: 00007FFDFABE5C37
PyErr_SetString.PYTHON313 ref: 00007FFDFABE5C4E
PyErr_SetString.PYTHON313 ref: 00007FFDFABE5D3E
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE5D6F
PyGILState_Release.PYTHON313 ref: 00007FFDFABE5D7D
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABE5DB5
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE5E48

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABE5C7F, 00007FFDFABE5DD7
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABE5C6A, 00007FFDFABE5DBF
There is no interface object registered that supports this IID, xrefs: 00007FFDFABE5C3D, 00007FFDFABE5D2D
Load, xrefs: 00007FFDFABE5E23

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: DeallocErr_$Object_State_String$ClearD@@@Dict_EnsureFromItemReleaseSubclassU_object@@
String ID: Load$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1864991668-1545106082
Opcode ID: 44df912321787dc32dc756038da9502cf7b1458dfe1b426d80b03f8551d2132a
Instruction ID: 702e7fb146bda2f1f991b58eea8bbcb4170f135ddf5cca3d4de29ae4d5576418
Opcode Fuzzy Hash: 44df912321787dc32dc756038da9502cf7b1458dfe1b426d80b03f8551d2132a
Instruction Fuzzy Hash: C9711B35B0CA4291EB599B15E8B4A7C63A4BF45B80F8485B1D92E877D8DF3CE855C301

Function 00007FFDFABF3AF0 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 158COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABF3B29
Py_BuildValue.PYTHON313 ref: 00007FFDFABF3B40
PyErr_Occurred.PYTHON313 ref: 00007FFDFABF3B65
PyErr_SetString.PYTHON313 ref: 00007FFDFABF3C15
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF3C69
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF3C7D
PyLong_AsLong.PYTHON313 ref: 00007FFDFABF3CA1
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF3CBA
PyGILState_Release.PYTHON313 ref: 00007FFDFABF3CC5
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABF3CF5

Strings

Unexpected exception in gateway method '%hs', xrefs: 00007FFDFABF3B80
The type does not declare a PyCom constructor, xrefs: 00007FFDFABF3D17
DragEnter, xrefs: 00007FFDFABF3B77, 00007FFDFABF3C3C
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABF3CFF
OlOl, xrefs: 00007FFDFABF3C27
There is no interface object registered that supports this IID, xrefs: 00007FFDFABF3C04

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Dealloc$Err_State_$BuildEnsureLongLong_Object_OccurredReleaseStringSubclassValue
String ID: DragEnter$OlOl$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$Unexpected exception in gateway method '%hs'
API String ID: 2824385799-2635543928
Opcode ID: 8ecca2a0575bbf928bbcf160c17d37f011078e99efe89957519320f94c0bfe0e
Instruction ID: 3bddd7906797277534ddd86ed978ec70521797639ab319f6a4ab1b9f2c7e75c3
Opcode Fuzzy Hash: 8ecca2a0575bbf928bbcf160c17d37f011078e99efe89957519320f94c0bfe0e
Instruction Fuzzy Hash: DE615135B09B8295EB599B65E864A7D63A0FF48B84F884071DD2E8B3D8DF3CE445D700

Function 00007FFDFABF3EE0 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 158COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABF3F19
Py_BuildValue.PYTHON313 ref: 00007FFDFABF3F30
PyErr_Occurred.PYTHON313 ref: 00007FFDFABF3F55
PyErr_SetString.PYTHON313 ref: 00007FFDFABF4005
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF4059
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF406D
PyLong_AsLong.PYTHON313 ref: 00007FFDFABF4091
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF40AA
PyGILState_Release.PYTHON313 ref: 00007FFDFABF40B5
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABF40E5

Strings

Unexpected exception in gateway method '%hs', xrefs: 00007FFDFABF3F70
The type does not declare a PyCom constructor, xrefs: 00007FFDFABF4107
Drop, xrefs: 00007FFDFABF3F67, 00007FFDFABF402C
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABF40EF
OlOl, xrefs: 00007FFDFABF4017
There is no interface object registered that supports this IID, xrefs: 00007FFDFABF3FF4

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Dealloc$Err_State_$BuildEnsureLongLong_Object_OccurredReleaseStringSubclassValue
String ID: Drop$OlOl$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$Unexpected exception in gateway method '%hs'
API String ID: 2824385799-3116030788
Opcode ID: 53577ef6b41296de838815d55e666a69bab1764cf993df41b462cda2a217814c
Instruction ID: d1490f987a2492fc81dcd29497b00a77998c9ff6526450620b9633f5da225220
Opcode Fuzzy Hash: 53577ef6b41296de838815d55e666a69bab1764cf993df41b462cda2a217814c
Instruction Fuzzy Hash: D5615D39B09A8295FB599B65E864A7D63E0FF48B84F884071DE2E863D8DF3CE445C300

Function 00007FFDFAC0A9E0 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 151COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC0AA02
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0AA31

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFAC0ABFA
Oii|i:CreateStorage, xrefs: 00007FFDFAC0AA79
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFAC0ABE5
There is no interface object registered that supports this IID, xrefs: 00007FFDFAC0ABB8
The Python object is invalid, xrefs: 00007FFDFAC0A9F4

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: Oii|i:CreateStorage$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1450464846-1065043913
Opcode ID: a97559f4304b59966ac1e986cca5a37a8e64a9f5af886c54af647efed9567353
Instruction ID: a030ae2f3e1b380cb353da791dcd27f79f385f43381cae8af90a7e44a3c6552c
Opcode Fuzzy Hash: a97559f4304b59966ac1e986cca5a37a8e64a9f5af886c54af647efed9567353
Instruction Fuzzy Hash: 5A613F3AB18A5295FB699B15E820A7D63A1FF84B84F488075DE6D837D8DF2CE445C700

Function 00007FFDFABD5C30 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 134COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABD5C92
PyErr_Format.PYTHON313 ref: 00007FFDFABD5CC2

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABD5E0A
O|OO&:CoGetObject, xrefs: 00007FFDFABD5C8B
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABD5DF5
There is no interface object registered that supports this IID, xrefs: 00007FFDFABD5DC8
BindOptions must be None, xrefs: 00007FFDFABD5CB1

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: BindOptions must be None$O|OO&:CoGetObject$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 361908667-3647525012
Opcode ID: db6debbea6c6eabd0b2c29d820ad2f6391d7eadb6a15f93ae409299e0512f76a
Instruction ID: ecd43abf2ced92326de4a152c201ecdde938fcddec3a3278197f9d8d2fd52c31
Opcode Fuzzy Hash: db6debbea6c6eabd0b2c29d820ad2f6391d7eadb6a15f93ae409299e0512f76a
Instruction Fuzzy Hash: AD511839B0CA4692FB589B15E864A7D23A4FF48B84F8445B1DD6E837A8DF3CE545C340

Function 00007FFDFABCFC20 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 127threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABCFC51
??0PyWin_AutoFreeBstr@@QEAA@PEA_W@Z.PYWINTYPES313 ref: 00007FFDFABCFC71
?SetBstr@PyWin_AutoFreeBstr@@QEAAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFABCFCAE
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABCFCB4
StgCreateDocfile.OLE32 ref: 00007FFDFABCFCD6
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABCFCE1
??1PyWin_AutoFreeBstr@@QEAA@XZ.PYWINTYPES313 ref: 00007FFDFABCFDED

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABCFDD1
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABCFDBC
There is no interface object registered that supports this IID, xrefs: 00007FFDFABCFD74
Oi|i:StgCreateDocfile, xrefs: 00007FFDFABCFC47

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: AutoBstr@@FreeWin_$Eval_Thread$Arg_Bstr@CreateDocfileParseRestoreSaveTuple
String ID: Oi|i:StgCreateDocfile$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 3573010966-4165331666
Opcode ID: 606cc0990c2b61725b9eb8bfdfcfbdbcf6b199a39b38c178d52815f849d56e81
Instruction ID: 46e99ac6f7aef942cb56d15785c08825edc67460346b6c7a0ddb1eee6ea898c3
Opcode Fuzzy Hash: 606cc0990c2b61725b9eb8bfdfcfbdbcf6b199a39b38c178d52815f849d56e81
Instruction Fuzzy Hash: 12513E39B18B0291FB589B25E864EBD63A1FF85B81F4540B1DA2E876ECDE3CE455C310

Function 00007FFDFABCFA00 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 135threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABCFA3A
?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z.PYWINTYPES313 ref: 00007FFDFABCFA52
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABCFA6A
CreateILockBytesOnHGlobal.OLE32 ref: 00007FFDFABCFA81
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABCFA8C

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABCFB99
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABCFB84
|Ol:CreateILockBytesOnHGlobal, xrefs: 00007FFDFABCFA24
There is no interface object registered that supports this IID, xrefs: 00007FFDFABCFB67

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocObject_U_object@@$Arg_BuildBytesCreateErr_ErrorFromGlobalInfoLockObjectParseTupleValue
String ID: The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$|Ol:CreateILockBytesOnHGlobal
API String ID: 830482936-536671445
Opcode ID: d5bd37bd21996c97541e66be15a5fa51a4b392a30520bdf80c328c686a5829a3
Instruction ID: 1d522eb37ad64ad917dd06d0668401659645e3498010d3447aa5510778276343
Opcode Fuzzy Hash: d5bd37bd21996c97541e66be15a5fa51a4b392a30520bdf80c328c686a5829a3
Instruction Fuzzy Hash: 44510A79B08B4282EB589B26E46097D63A1FB88BD1F4940B1DE6E4379DDF3CE445C700

Function 00007FFDFABEFEE0 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 128threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABEFEFC
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABEFF30
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFABEFF4A
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABEFF5E
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABEFF85
SysFreeString.OLEAUT32 ref: 00007FFDFABEFF90
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABEFFF3
PyDict_GetItem.PYTHON313 ref: 00007FFDFABF000B
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF0022
PyErr_Clear.PYTHON313 ref: 00007FFDFABF002D
PyErr_SetString.PYTHON313 ref: 00007FFDFABF0044
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF004A
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF005F
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABF0081

Strings

Ol:CreateTypeInfo, xrefs: 00007FFDFABEFF29
The type does not declare a PyCom constructor, xrefs: 00007FFDFABF00A0
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABF008B
There is no interface object registered that supports this IID, xrefs: 00007FFDFABF0033
The Python object is invalid, xrefs: 00007FFDFABEFEEE

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_Object_String$RestoreSaveU_object@@$Arg_Bstr@@ClearD@@@DeallocDict_FreeFromItemParseSubclassTuple
String ID: Ol:CreateTypeInfo$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1691665561-470477504
Opcode ID: e6a91ae5466056d21db2a7db339371a8906dfcbcd1ad10b6fbaed559b8166e6d
Instruction ID: bfdd21e097b3015953dd13ee4ef73d2a181c404ec052c659c3d40274a1be0488
Opcode Fuzzy Hash: e6a91ae5466056d21db2a7db339371a8906dfcbcd1ad10b6fbaed559b8166e6d
Instruction Fuzzy Hash: BE513C69B19A4281FB499B25E86497D63A1FF85BC0F8840B1DE6E477ECDE2CE445C700

Function 00007FFDFAC09ED0 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 127threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC09EFF
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC09F13
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC09F27
PyErr_SetString.PYTHON313 ref: 00007FFDFAC09F44
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC09F81
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC09FA8
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC0A00E
PyDict_GetItem.PYTHON313 ref: 00007FFDFAC0A026
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC0A03D
PyErr_Clear.PYTHON313 ref: 00007FFDFAC0A048
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0A05F
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0A065
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0A07A
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFAC0A091

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFAC0A0B0
OO:QueryService, xrefs: 00007FFDFAC09EF8
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFAC0A09B
There is no interface object registered that supports this IID, xrefs: 00007FFDFAC0A04E
The Python object is invalid, xrefs: 00007FFDFAC09F36

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Object_Thread$D@@@Err_U_object@@$RestoreSaveString$Arg_ClearDeallocDict_FromItemParseSubclassTuple
String ID: OO:QueryService$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1966702985-2900168733
Opcode ID: 014b7dbc18d6f57e20c4a92378513645a19fe1e672168b71614921e4353e8011
Instruction ID: 5fc82fbb70e4e290cc1be2162e0f4c9038dc389f864b30d9f306b2d62a34236c
Opcode Fuzzy Hash: 014b7dbc18d6f57e20c4a92378513645a19fe1e672168b71614921e4353e8011
Instruction Fuzzy Hash: 60515B2DB18A5691FB589B25E824A7D63B0FF84BC4F4880B1D96E877ECDF2CE4458700

Function 00007FFDFABF8940 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 126threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABF8956
PyErr_SetString.PYTHON313 ref: 00007FFDFABF8973
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF8998
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF89B5
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABF8A0D
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF8A1B
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF8A30
PyDict_GetItem.PYTHON313 ref: 00007FFDFABF8A52
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF8A69
PyErr_Clear.PYTHON313 ref: 00007FFDFABF8A74
PyErr_SetString.PYTHON313 ref: 00007FFDFABF8A8B
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF8A91
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF8AA6
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABF8AC8

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABF8AE7
:Clone, xrefs: 00007FFDFABF894F
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABF8AD2
There is no interface object registered that supports this IID, xrefs: 00007FFDFABF8A7A
The Python object is invalid, xrefs: 00007FFDFABF8965

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSave$Object_String$Arg_ClearD@@@DeallocDict_FromItemParseSubclassTupleU_object@@
String ID: :Clone$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1062860496-175512089
Opcode ID: 013078dee56a493039382bc8f6841cb040b346cd382a9bf0d24c3f95d9449f2a
Instruction ID: 75b73c9b5ac6d0441e1cc2d68a6265224bdc9e075ce05942c9c8c33c1d7b318b
Opcode Fuzzy Hash: 013078dee56a493039382bc8f6841cb040b346cd382a9bf0d24c3f95d9449f2a
Instruction Fuzzy Hash: 47513069B18A4281FB4D9B95E96497D63E1FF48BC0B8850B1D92E477DCDF2CE4458300

Function 00007FFDFABD2950 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 126threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABD2972
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABD298A
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD29AE
GetActiveObject.OLEAUT32 ref: 00007FFDFABD29C3
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD29CE
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD29F1
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD2A21
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABD2A44
PyDict_GetItem.PYTHON313 ref: 00007FFDFABD2A5C
_Py_Dealloc.PYTHON313 ref: 00007FFDFABD2A72
PyErr_Clear.PYTHON313 ref: 00007FFDFABD2A7D
PyErr_SetString.PYTHON313 ref: 00007FFDFABD2A94
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD2A9A
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD2AAF
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABD2AC1

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABD2AE0
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABD2ACB
O:Connect, xrefs: 00007FFDFABD296B
There is no interface object registered that supports this IID, xrefs: 00007FFDFABD2A83

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Object_RestoreSave$D@@@Err_U_object@@$ActiveArg_ClearDeallocDict_FromItemObjectParseStringSubclassTuple
String ID: O:Connect$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 3189202653-685158464
Opcode ID: fb32afdec469271614cca1a4a8ef09c28be4a29631b2a3156b5743866c1a9132
Instruction ID: 748ccd8c283d18c9bbf9b8ebbfa78846917600b4f1f92f3427fa04c5a1827212
Opcode Fuzzy Hash: fb32afdec469271614cca1a4a8ef09c28be4a29631b2a3156b5743866c1a9132
Instruction Fuzzy Hash: DB51FC39B08B8295FB189F15E86497D63E1FF88B84B8441B6D96E477ACDF3CE5068700

Function 00007FFDFABF1B30 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 124COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABF1B4C
PyErr_SetString.PYTHON313 ref: 00007FFDFABF1B71

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABF1CD6
:EnumDAdvise, xrefs: 00007FFDFABF1B7F
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABF1CC1
There is no interface object registered that supports this IID, xrefs: 00007FFDFABF1C69
The Python object is invalid, xrefs: 00007FFDFABF1B45

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: :EnumDAdvise$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1450464846-3000112118
Opcode ID: 43d0dea53b9b20bbe007167d3d0a45052f10dcc43ea1ad341977d03ef3e2a085
Instruction ID: ecbcff9e470fa7466596d76d3cbe80b52012d0d46ced199fb1efe0398a5131b7
Opcode Fuzzy Hash: 43d0dea53b9b20bbe007167d3d0a45052f10dcc43ea1ad341977d03ef3e2a085
Instruction Fuzzy Hash: B2512E29B08A4282FB599B55F96497D63E1FF48BC0B8854B5DA2E477ECDF2CE4858300

Function 00007FFDFABEBC40 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABEBC5A
PyErr_SetString.PYTHON313 ref: 00007FFDFABEBC77
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABEBCA1
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABEBCBE
PyErr_SetString.PYTHON313 ref: 00007FFDFABEBCDF
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABEBD40
PyDict_GetItem.PYTHON313 ref: 00007FFDFABEBD58
_Py_Dealloc.PYTHON313 ref: 00007FFDFABEBD6F
PyErr_Clear.PYTHON313 ref: 00007FFDFABEBD7A
PyErr_SetString.PYTHON313 ref: 00007FFDFABEBD91
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABEBD97
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABEBDAC
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABEBDCE

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABEBDED
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABEBDD8
:GetConnectionPointContainer, xrefs: 00007FFDFABEBC53
There is no interface object registered that supports this IID, xrefs: 00007FFDFABEBD80
The Python object is invalid, xrefs: 00007FFDFABEBC69

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_Eval_Thread$String$Object_RestoreSave$Arg_ClearD@@@DeallocDict_FromItemParseSubclassTupleU_object@@
String ID: :GetConnectionPointContainer$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1575696441-444689646
Opcode ID: 525832f0013da9adf25ab31d72b32060b455b744a73e5408a89de19b96dee689
Instruction ID: ed5333bd9b8d4fd1630d6a46559a30689c5a01e5e0143aca7e93fffa6325cb4f
Opcode Fuzzy Hash: 525832f0013da9adf25ab31d72b32060b455b744a73e5408a89de19b96dee689
Instruction Fuzzy Hash: 57515229B18A4291FB5D9B15E8A497D23E0FF48BC4B4494B1DE2E877ECDF2CE8518301

Function 00007FFDFABE8910 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 124COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABE892C
PyErr_SetString.PYTHON313 ref: 00007FFDFABE8951

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABE8AB6
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABE8AA1
:EnumObjectParam, xrefs: 00007FFDFABE895F
There is no interface object registered that supports this IID, xrefs: 00007FFDFABE8A49
The Python object is invalid, xrefs: 00007FFDFABE8925

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: :EnumObjectParam$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1450464846-1596834398
Opcode ID: 485adf1e539dd6248f48350dcdb1cb228a3bfa67d5c6f330a82b87a4a3163f57
Instruction ID: 9491ca14838a8753d27340d34d8a9dbbf5f0b46f6c37f491ca4c8a43f97ca9e5
Opcode Fuzzy Hash: 485adf1e539dd6248f48350dcdb1cb228a3bfa67d5c6f330a82b87a4a3163f57
Instruction Fuzzy Hash: 98513F29F08A4282FB599B55F86497D23E1FF48BC0B8854B1DD2E477ECDE2CE8958301

Function 00007FFDFAC0CA10 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 122COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFAC0CA3A
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC0CA6B
PyDict_GetItem.PYTHON313 ref: 00007FFDFAC0CA83
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC0CA9A
PyErr_Clear.PYTHON313 ref: 00007FFDFAC0CAA9
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0CAC0
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC0CACB
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC0CAD7
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC0CB2E
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC0CB47
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC0CB60
PyGILState_Release.PYTHON313 ref: 00007FFDFAC0CB69
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFAC0CB9A

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFAC0CBBC
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFAC0CBA4
MoveElementTo, xrefs: 00007FFDFAC0CAFE
OOOi, xrefs: 00007FFDFAC0CAEB
There is no interface object registered that supports this IID, xrefs: 00007FFDFAC0CAAF

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: DeallocObject_$FromU_object@@$Err_State_$ClearD@@@Dict_EnsureItemReleaseStringSubclass
String ID: MoveElementTo$OOOi$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 2641330681-1586369414
Opcode ID: d6ba91dd93a06f6a4bb7c99dba9a8896fa276a6e25aa49c79ecca76c75c2fbcc
Instruction ID: 3cc84a1c7654c0f1b3e81e3e50e157b70bbfc8cf69b4bf4a5c0c283685d7f069
Opcode Fuzzy Hash: d6ba91dd93a06f6a4bb7c99dba9a8896fa276a6e25aa49c79ecca76c75c2fbcc
Instruction Fuzzy Hash: C5513939B0DB5282EB589B26E864A7D63A0FF45F94F0884B1DA6D837D8DF3CE4458700

Function 00007FFDFABD3AC0 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 112threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABD3ADB
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFABD3B0B
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD3B19
CreateFileMoniker.OLE32 ref: 00007FFDFABD3B2C
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD3B37
PyMem_Free.PYTHON313 ref: 00007FFDFABD3C4D

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABD3C2C
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABD3C17
O:CreateFileMoniker, xrefs: 00007FFDFABD3AD4
There is no interface object registered that supports this IID, xrefs: 00007FFDFABD3BEA

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_CreateFileFreeMem_MonikerObject_ParseRestoreSaveTupleU_object@@
String ID: O:CreateFileMoniker$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 565804598-1758587608
Opcode ID: 4dd5e0ff521f154bc2afb0b6adef986d5d558d43bd44d34be9b8b01c90d43e29
Instruction ID: 311e707dae08e7d560332de779c37b7636fad1b067cadd910290bab62af81259
Opcode Fuzzy Hash: 4dd5e0ff521f154bc2afb0b6adef986d5d558d43bd44d34be9b8b01c90d43e29
Instruction Fuzzy Hash: 33411D29B08B4695FB5D9B19E860A7DA3E0FF84B84F4844B1D92E877D9DF3CE5058300

Function 00007FFDFABCA9A0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

PyLong_AsLong.PYTHON313 ref: 00007FFDFABCAA09
PyErr_Occurred.PYTHON313 ref: 00007FFDFABCAA17
PyErr_Clear.PYTHON313 ref: 00007FFDFABCAA22
PySequence_GetItem.PYTHON313 ref: 00007FFDFABCAA67
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFABCAA88
_Py_Dealloc.PYTHON313 ref: 00007FFDFABCAAA0
PyErr_SetString.PYTHON313 ref: 00007FFDFABCAB46

Strings

At least one argument must be supplied, xrefs: 00007FFDFABCA9BE
The Python object is invalid, xrefs: 00007FFDFABCAAD6

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$Bstr@@ClearDeallocItemLongLong_Object_OccurredSequence_StringU_object@@
String ID: At least one argument must be supplied$The Python object is invalid
API String ID: 2430672833-3086978936
Opcode ID: d6de1277b3e16bad5928eabb63b6a067bd87b38e4c8d860b4bbda19017daf698
Instruction ID: 71d9c7645f8245941cb6a9869b45c14fbd290e504af1226167263e7fccf90e79
Opcode Fuzzy Hash: d6de1277b3e16bad5928eabb63b6a067bd87b38e4c8d860b4bbda19017daf698
Instruction Fuzzy Hash: D171A129B2C64692FB189B25A960D3E3392FF44B94F854579DE2E437D8DE3DE441C300

Function 00007FFDFAC06A60 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 161COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFAC06A90

Part of subcall function 00007FFDFAC03F70: PyTuple_New.PYTHON313 ref: 00007FFDFAC03F92
Part of subcall function 00007FFDFAC03F70: PyLong_FromUnsignedLong.PYTHON313 ref: 00007FFDFAC03FB2

PyErr_Occurred.PYTHON313 ref: 00007FFDFAC06AC7
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC06B2F
memset.VCRUNTIME140 ref: 00007FFDFAC06B53
?PyWinSequence_Tuple@@YAPEAU_object@@PEAU1@PEAK@Z.PYWINTYPES313 ref: 00007FFDFAC06B62
PyErr_SetString.PYTHON313 ref: 00007FFDFAC06B8F
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC06BAB
PyErr_Occurred.PYTHON313 ref: 00007FFDFAC06C5B
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC06CA0
PyGILState_Release.PYTHON313 ref: 00007FFDFAC06CAC

Strings

Unexpected exception in gateway method '%hs', xrefs: 00007FFDFAC06AE3, 00007FFDFAC06C74
ReadPropertyNames, xrefs: 00007FFDFAC06ADA, 00007FFDFAC06B10, 00007FFDFAC06C6B
Sequence not of required length, xrefs: 00007FFDFAC06B85

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: DeallocErr_$OccurredState_$EnsureFromLongLong_ReleaseSequence_StringTuple@@Tuple_U_object@@Unsignedmemset
String ID: ReadPropertyNames$Sequence not of required length$Unexpected exception in gateway method '%hs'
API String ID: 3307134239-3243179091
Opcode ID: 96577e9c1c2d0fd5cde0bc7314309dde67ef386be9c1fc41d7773932922001c8
Instruction ID: c0da2dec5bac47f0609bcbeb6cebc7f712d108601071ae94ee947fba3342987a
Opcode Fuzzy Hash: 96577e9c1c2d0fd5cde0bc7314309dde67ef386be9c1fc41d7773932922001c8
Instruction Fuzzy Hash: 5E61817AB19A5291EB589F25E824A7D33B0FF44B94F489071D9AE876DCDE7CE444C300

Function 00007FFDFABE7F20 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABE7F36
PyErr_SetString.PYTHON313 ref: 00007FFDFABE7F53
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABE7F7D
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABE7F9A
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABE7FFD
PyDict_GetItem.PYTHON313 ref: 00007FFDFABE8015
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE802C
PyErr_Clear.PYTHON313 ref: 00007FFDFABE8037
PyErr_SetString.PYTHON313 ref: 00007FFDFABE804E
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABE8054
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABE8069
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABE808B

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABE80AA
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABE8095
:GetRunningObjectTable, xrefs: 00007FFDFABE7F2F
There is no interface object registered that supports this IID, xrefs: 00007FFDFABE803D
The Python object is invalid, xrefs: 00007FFDFABE7F45

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_$Object_RestoreSaveString$Arg_ClearD@@@DeallocDict_FromItemParseSubclassTupleU_object@@
String ID: :GetRunningObjectTable$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 195898724-2623800328
Opcode ID: c0892c4c074c83a2864484937a27724f1a278c7a699297f4570f7e23a64ec22c
Instruction ID: bc2a9bb3ca8461801c844c4fc7b6fc18c57f66324c85ccd362f38b0f2bf4a85c
Opcode Fuzzy Hash: c0892c4c074c83a2864484937a27724f1a278c7a699297f4570f7e23a64ec22c
Instruction Fuzzy Hash: D2515F29B18A4281FB5D9B55E9A497D63A1FF48BC0B4850B1DE2E477ECDE2CE8458301

Function 00007FFDFABD69A0 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 115threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABD69C0
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFABD69F0
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD6A03
CreateTypeLib2.OLEAUT32 ref: 00007FFDFABD6A1A
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD6A25
PyMem_Free.PYTHON313 ref: 00007FFDFABD6B3B

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABD6B1A
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABD6B05
There is no interface object registered that supports this IID, xrefs: 00007FFDFABD6AD8

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_CreateFreeLib2Mem_Object_ParseRestoreSaveTupleTypeU_object@@
String ID: The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 2163282249-49823770
Opcode ID: 7daf49e6d55556a213d1a2da487b843bd595af3f06e05594ca9932f48e932023
Instruction ID: 45b8b69b38cbc8d317cbbb2d834ed1cab28a547bdcf9d1d83f3e90187c7d512d
Opcode Fuzzy Hash: 7daf49e6d55556a213d1a2da487b843bd595af3f06e05594ca9932f48e932023
Instruction Fuzzy Hash: 98512B29F18A4291FB199B15E870A7D63E0FF48B94F8850B1D96E876E8DE3CE845C700

Function 00007FFDFAC08BD0 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 110threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC08BE6
PyErr_SetString.PYTHON313 ref: 00007FFDFAC08C03
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC08C39
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC08C56
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC08CB7
PyDict_GetItem.PYTHON313 ref: 00007FFDFAC08CCF
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC08CE5
PyErr_Clear.PYTHON313 ref: 00007FFDFAC08CF0
PyErr_SetString.PYTHON313 ref: 00007FFDFAC08D07
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC08D0D
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC08D22
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFAC08D3A

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFAC08D59
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFAC08D44
:EnumRunning, xrefs: 00007FFDFAC08BDF
There is no interface object registered that supports this IID, xrefs: 00007FFDFAC08CF6
The Python object is invalid, xrefs: 00007FFDFAC08BF5

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_$Object_RestoreSaveString$Arg_ClearD@@@DeallocDict_FromItemParseSubclassTupleU_object@@
String ID: :EnumRunning$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 195898724-1508251384
Opcode ID: 9a7b223e5cf46877d69bdc5c606ee63e3b67541f90ea838d8dad410d925fbd15
Instruction ID: d3ac03f4e69277b94e0ed9eac36cac59bac99e366b8bfcd0af316658d75b5561
Opcode Fuzzy Hash: 9a7b223e5cf46877d69bdc5c606ee63e3b67541f90ea838d8dad410d925fbd15
Instruction Fuzzy Hash: EE410629B09B6285FB199B19A86497D33F1FF48BC0B4890B1DE6E877D8DE2CF4458300

Function 00007FFDFAC07EF0 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 110threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC07F06
PyErr_SetString.PYTHON313 ref: 00007FFDFAC07F23
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC07F59
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC07F76
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC07FD7
PyDict_GetItem.PYTHON313 ref: 00007FFDFAC07FEF
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC08005
PyErr_Clear.PYTHON313 ref: 00007FFDFAC08010
PyErr_SetString.PYTHON313 ref: 00007FFDFAC08027
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0802D
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC08042
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFAC0805A

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFAC08079
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFAC08064
:GetClassInfo, xrefs: 00007FFDFAC07EFF
There is no interface object registered that supports this IID, xrefs: 00007FFDFAC08016
The Python object is invalid, xrefs: 00007FFDFAC07F15

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_$Object_RestoreSaveString$Arg_ClearD@@@DeallocDict_FromItemParseSubclassTupleU_object@@
String ID: :GetClassInfo$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 195898724-1225286267
Opcode ID: d94db4881660b8103bff40fd25258975a005712a5af6fd375c21c33e436080e1
Instruction ID: 2206fba4ee464124940242c80ecfc0532ff72d0178b091975ecd4241b4297857
Opcode Fuzzy Hash: d94db4881660b8103bff40fd25258975a005712a5af6fd375c21c33e436080e1
Instruction Fuzzy Hash: C1411729B08B1295FB5D9B26A86497D63F1EF48BC0F4894B1DE6E877DCDE2CE4458300

Function 00007FFDFAC02AF0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 134threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC02B2D
PyErr_SetString.PYTHON313 ref: 00007FFDFAC02B4A
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFAC02B8E
PyObject_IsInstance.PYTHON313 ref: 00007FFDFAC02BC9
PyErr_Format.PYTHON313 ref: 00007FFDFAC02BEC
PyErr_SetString.PYTHON313 ref: 00007FFDFAC02C1D
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC02C28
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC02C4E
VariantInit.OLEAUT32 ref: 00007FFDFAC02C72
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC02C85
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC02CC3

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

PyMem_Free.PYTHON313 ref: 00007FFDFAC02D06

Strings

argument is not a COM object (got type=%s), xrefs: 00007FFDFAC02BDB
O|iO:Read, xrefs: 00007FFDFAC02B23
The Python object is invalid, xrefs: 00007FFDFAC02B3C

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Err_$Object_$DeallocStringU_object@@$Arg_BuildErrorFormatFreeFromInfoInitInstanceMem_ObjectParseTupleValueVariant
String ID: O|iO:Read$The Python object is invalid$argument is not a COM object (got type=%s)
API String ID: 607326736-616561353
Opcode ID: 5f13d4bfba2efd8734c9fb97c34c160d95aba1579116fa4f6e8d655ce63382f3
Instruction ID: d4583920009715f7a4669dba8950c8674731d87cc2e63b7b616ad83c61741483
Opcode Fuzzy Hash: 5f13d4bfba2efd8734c9fb97c34c160d95aba1579116fa4f6e8d655ce63382f3
Instruction Fuzzy Hash: FB513D29B08A5691FB589F51E8649BD67B0FF44B80F598072DE6E836A8DE3CD449C340

Function 00007FFDFAC019B0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 132COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC019CE
PyErr_SetString.PYTHON313 ref: 00007FFDFAC019F5

Strings

Oi:Save, xrefs: 00007FFDFAC01A12
The Python object is NULL and no error occurred, xrefs: 00007FFDFAC01A38
argument is not a COM object (got type=%s), xrefs: 00007FFDFAC01A83
None is not a valid interface object in this context, xrefs: 00007FFDFAC01A62
The Python object is invalid, xrefs: 00007FFDFAC019C7

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: None is not a valid interface object in this context$Oi:Save$The Python object is NULL and no error occurred$The Python object is invalid$argument is not a COM object (got type=%s)
API String ID: 1450464846-517254404
Opcode ID: bd39401af89422807ce7559fa9bd05dd80c8059ff4be916bb74a3ac424a834f8
Instruction ID: 4c7ac2b383c5c8c48ff66b3fe91e314020f8f8f8ca12358a0b4affab5416b863
Opcode Fuzzy Hash: bd39401af89422807ce7559fa9bd05dd80c8059ff4be916bb74a3ac424a834f8
Instruction Fuzzy Hash: 09514369B08A5292FB099F55E8649BD63A0EF44FD5B4850B2CD2D973D8DE3CE885C340

Function 00007FFDFAC118F0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 108COMMON

Download Yara Rule

APIs

PyLong_AsLong.PYTHON313 ref: 00007FFDFAC11920
PySequence_Check.PYTHON313 ref: 00007FFDFAC11932
PySequence_Size.PYTHON313 ref: 00007FFDFAC11943
PySequence_GetItem.PYTHON313 ref: 00007FFDFAC1195D
PySequence_GetItem.PYTHON313 ref: 00007FFDFAC1196E
PyErr_SetString.PYTHON313 ref: 00007FFDFAC11998
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC11A42
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC11A60

Strings

The object is not an TYPEDESC, xrefs: 00007FFDFAC11A71
If the TYPEDESC is of type VT_USERDEFINED, the object must be an integer, xrefs: 00007FFDFAC119D7
The first sequence item must be an integer, xrefs: 00007FFDFAC11987
SAFEARRAY descriptions are not yet supported, xrefs: 00007FFDFAC119F4

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Sequence_$DeallocItem$CheckErr_LongLong_SizeString
String ID: If the TYPEDESC is of type VT_USERDEFINED, the object must be an integer$SAFEARRAY descriptions are not yet supported$The first sequence item must be an integer$The object is not an TYPEDESC
API String ID: 3972667259-4167263409
Opcode ID: 0d4a7940860b962bc09089243b53c8da471959ed3848b1469a49f9e544ca58e9
Instruction ID: 6c5dfde094b458c47e1641afa8991dd41352f841a17ebb734ba71108f78636ea
Opcode Fuzzy Hash: 0d4a7940860b962bc09089243b53c8da471959ed3848b1469a49f9e544ca58e9
Instruction Fuzzy Hash: 2E412B29B18742A5FB5C9B26E464A7D67E0EF44F80F1490B9DA6E466D8DF3CE446C300

Function 00007FFDFABF6B60 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 109threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABF6B8B
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF6BA3
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF6BC0

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABF6CD4
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABF6CBF
There is no interface object registered that supports this IID, xrefs: 00007FFDFABF6C67
The Python object is invalid, xrefs: 00007FFDFABF6B6B

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocErr_$BuildErrorFromInfoObjectObject_StringU_object@@Value
String ID: The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 3213920475-3895418669
Opcode ID: ff8adc6b9ee4605b1571758dd9ee2e144ca43d7c99b8b5e22cf6490a84a253cc
Instruction ID: 6441c5bd40cceec6dc66470eb2ece16ec868f3c9138373f6f593a2b538cdbd4f
Opcode Fuzzy Hash: ff8adc6b9ee4605b1571758dd9ee2e144ca43d7c99b8b5e22cf6490a84a253cc
Instruction Fuzzy Hash: D9414E29B09A8282FB5D9B55E87497D63A0FF48BC0F8854B5DE6E477ECDE2CE4458300

Function 00007FFDFAC0FAE0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 107threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC0FB23
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0FB40
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0FB5F

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFAC0FC4C
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFAC0FC37
There is no interface object registered that supports this IID, xrefs: 00007FFDFAC0FBEF
The Python object is invalid, xrefs: 00007FFDFAC0FB03

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocErr_$BuildErrorFromInfoObjectObject_StringU_object@@Value
String ID: The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 3213920475-3895418669
Opcode ID: f5915551523a34e527b5c14ca623234ebbb0ea4c32344bfcbdec0dc9fff4b199
Instruction ID: 2f1332eab23273dce9da9f1d6e5498c5b4ab1945bb965acbc3df3ae7d363ccf8
Opcode Fuzzy Hash: f5915551523a34e527b5c14ca623234ebbb0ea4c32344bfcbdec0dc9fff4b199
Instruction Fuzzy Hash: 3D413929B0CB5285FB589B15A86097C23B0FF48F84B4880B2DE6E877DCDE2CE485C750

Function 00007FFDFAC0F960 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 104threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC0F99B
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0F9AF
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0F9E7
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC0FA18
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC0FA26
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC0FA34
Py_BuildValue.PYTHON313 ref: 00007FFDFAC0FA54
SysFreeString.OLEAUT32 ref: 00007FFDFAC0FA62
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC0FA7B
SysFreeString.OLEAUT32 ref: 00007FFDFAC0FA86
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC0FA9F
SysFreeString.OLEAUT32 ref: 00007FFDFAC0FAAA
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC0FAC3

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

Strings

(OOiO), xrefs: 00007FFDFAC0FA3F
The Python object is invalid, xrefs: 00007FFDFAC0F97B

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Dealloc$FromObject_RestoreSaveStringU_object@@$Free$BuildErr_Value$ErrorInfoObject
String ID: (OOiO)$The Python object is invalid
API String ID: 1273995065-2415557319
Opcode ID: 70dcb869b696e82eab7625dbc7b93f871b47df504a084c4ca9a3bb0da9b40d9e
Instruction ID: fbec84de13ec76bd1c9e78788942bf2ea1a13b1bf50d2429106778dc9944ff9c
Opcode Fuzzy Hash: 70dcb869b696e82eab7625dbc7b93f871b47df504a084c4ca9a3bb0da9b40d9e
Instruction Fuzzy Hash: 07414E39B08B5286EB189F25F46497D63A0FB88B90F088071DE5D937A8DF3CD485C740

Function 00007FFDFAC15970 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32 ref: 00007FFDFAC15993
SafeArrayGetUBound.OLEAUT32 ref: 00007FFDFAC159C7
SafeArrayAccessData.OLEAUT32 ref: 00007FFDFAC159F3

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

Strings

buffer size is not what we created!, xrefs: 00007FFDFAC15A5E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$ArrayRestoreSafeSave$BoundDealloc$AccessBuildDataErr_ErrorFromInfoObjectObject_U_object@@Value
String ID: buffer size is not what we created!
API String ID: 576285022-976286230
Opcode ID: c91fe32572f4a50a4fbe0deb4edbce311861984f733a6a1fee411f3dd7132e04
Instruction ID: c498faae1d73fef319d7a988d2a66def00aecdd5c9b9789d484be44b4ea7e5d7
Opcode Fuzzy Hash: c91fe32572f4a50a4fbe0deb4edbce311861984f733a6a1fee411f3dd7132e04
Instruction Fuzzy Hash: DC51A13AB1D686A6EB688B11E4A4B7D63A4FB84B44F404071DA2E577ECDF3CE445C700

Function 00007FFDFABF8B10 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABF8B2E
PySequence_Check.PYTHON313 ref: 00007FFDFABF8B84
PyObject_Size.PYTHON313 ref: 00007FFDFABF8B9A
PySequence_GetItem.PYTHON313 ref: 00007FFDFABF8BEB
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABF8C63
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF8C7B
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF8CA2
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF8CC4
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF8CE7
PyErr_Clear.PYTHON313 ref: 00007FFDFABF8CEF
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF8D08
PyGILState_Release.PYTHON313 ref: 00007FFDFABF8D30

Strings

Next, xrefs: 00007FFDFABF8B53
O&O&kO&O&O&:STATPROPSETSTG, xrefs: 00007FFDFABF8C3B

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Dealloc$Sequence_State_$Arg_CheckClearEnsureErr_ItemObject_ParseReleaseSizeTuple
String ID: Next$O&O&kO&O&O&:STATPROPSETSTG
API String ID: 2265416999-2759803156
Opcode ID: 14bc9990cc337212dedeb920a2ca8f67ffa493a4f8af14027d36528662da41d5
Instruction ID: 861ea6ca708766844f5d7dbd0fec27f16b9490b288a443d71d595d38c64196d1
Opcode Fuzzy Hash: 14bc9990cc337212dedeb920a2ca8f67ffa493a4f8af14027d36528662da41d5
Instruction Fuzzy Hash: 70517D36B0AB8691E7288FA5E924A7973A0FB44B94F484171DA6D93BD8DF3CE411C700

Function 00007FFDFABC8B70 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABC8BAC
PyObject_CallMethod.PYTHON313 ref: 00007FFDFABC8C16
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC8C2D
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC8C41
SysFreeString.OLEAUT32 ref: 00007FFDFABC8CA3
SysFreeString.OLEAUT32 ref: 00007FFDFABC8CB6
SysFreeString.OLEAUT32 ref: 00007FFDFABC8CC9
SysFreeString.OLEAUT32 ref: 00007FFDFABC8CEB

Part of subcall function 00007FFDFABC8550: PyNumber_Check.PYTHON313 ref: 00007FFDFABC85B4
Part of subcall function 00007FFDFABC8550: PyLong_AsLong.PYTHON313 ref: 00007FFDFABC85C1
Part of subcall function 00007FFDFABC8550: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC85D7

SysFreeString.OLEAUT32 ref: 00007FFDFABC8CFE
SysFreeString.OLEAUT32 ref: 00007FFDFABC8D11
PyGILState_Release.PYTHON313 ref: 00007FFDFABC8D58

Strings

iOiO, xrefs: 00007FFDFABC8BE6
Python error invoking COM method., xrefs: 00007FFDFABC8C64
_Invoke_, xrefs: 00007FFDFABC8BF5

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: FreeString$Dealloc$State_$CallCheckEnsureLongLong_MethodNumber_Object_Release
String ID: Python error invoking COM method.$_Invoke_$iOiO
API String ID: 901979272-3232567516
Opcode ID: 6c7c9b64f419ac58f1d17edf5f438223d308ceb8c4d5cfba570f0057f856cacc
Instruction ID: 450ca2211c2645df8dd37dcf945ccba37d4e6de939d9d64ea4ce6b88b5715ec1
Opcode Fuzzy Hash: 6c7c9b64f419ac58f1d17edf5f438223d308ceb8c4d5cfba570f0057f856cacc
Instruction Fuzzy Hash: 9C516C3AB09B4281EB189F61E860ABA73A0FB84B94F454475DE6E43B9DCF3CE455C740

Function 00007FFDFAC01B70 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 118threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC01BBF
PyErr_Occurred.PYTHON313 ref: 00007FFDFAC01BD3
PyErr_SetString.PYTHON313 ref: 00007FFDFAC01BEF
PyObject_IsInstance.PYTHON313 ref: 00007FFDFAC01C23
PyErr_Format.PYTHON313 ref: 00007FFDFAC01C46
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC01C6B
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC01C8E
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC01CBA
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC01CE3

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

Strings

The Python object is NULL and no error occurred, xrefs: 00007FFDFAC01BDE
O:SaveCompleted, xrefs: 00007FFDFAC01BB8
argument is not a COM object (got type=%s), xrefs: 00007FFDFAC01C31
None is not a valid interface object in this context, xrefs: 00007FFDFAC01C10
The Python object is invalid, xrefs: 00007FFDFAC01B8E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Err_$DeallocObject_$Arg_BuildErrorFormatFromInfoInstanceObjectOccurredParseStringTupleU_object@@Value
String ID: None is not a valid interface object in this context$O:SaveCompleted$The Python object is NULL and no error occurred$The Python object is invalid$argument is not a COM object (got type=%s)
API String ID: 21361869-2286507262
Opcode ID: 73dba996eeb027f0992288a423fc271c65433eff595f39c70c281eb272f33d76
Instruction ID: 5626cf84fd5e018034f23a6b1b71cf00b1f172d82781be69fd9d6ef210b7c9ab
Opcode Fuzzy Hash: 73dba996eeb027f0992288a423fc271c65433eff595f39c70c281eb272f33d76
Instruction Fuzzy Hash: 15514D69B08A5291EB58DB1AE46097D63B0FF48FC4B4840B2DE6D977ACDF3CE4458340

Function 00007FFDFABE5E60 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABE5EA5
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABE5EB4
PyDict_GetItem.PYTHON313 ref: 00007FFDFABE5ECC
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE5EE3
PyErr_Clear.PYTHON313 ref: 00007FFDFABE5EEE
PyErr_SetString.PYTHON313 ref: 00007FFDFABE5F05
PyGILState_Release.PYTHON313 ref: 00007FFDFABE5F2B
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFABE5F65
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE5FFB

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFABE5F84
Save, xrefs: 00007FFDFABE5FCD
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFABE5F6F
Oii, xrefs: 00007FFDFABE5FC1
There is no interface object registered that supports this IID, xrefs: 00007FFDFABE5EF4

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: DeallocErr_Object_State_$ClearD@@@Dict_EnsureFromItemReleaseStringSubclassU_object@@
String ID: Oii$Save$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 643398647-4246081452
Opcode ID: c807c37abc8151cc9ec5a129b8f01122fe823c80d84d69c2898bccd48247a446
Instruction ID: 29b35dd9c656049985243522867cea8de8f595a8823d73c2083db241825f4da0
Opcode Fuzzy Hash: c807c37abc8151cc9ec5a129b8f01122fe823c80d84d69c2898bccd48247a446
Instruction Fuzzy Hash: 41414A39B0CA4682EB589B16E8B4A7C63E4FB44B90F844571DE6E47798EF3CE845C701

Function 00007FFDFABD5AA0 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 102threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABD5AC2
PyErr_Occurred.PYTHON313 ref: 00007FFDFABD5AD6
PyErr_SetString.PYTHON313 ref: 00007FFDFABD5AF2
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABD5B21
PyErr_Format.PYTHON313 ref: 00007FFDFABD5B44
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD5B70
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD5B93
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD5BBA
CoReleaseMarshalData.OLE32 ref: 00007FFDFABD5BC8
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD5BDE

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

Strings

The Python object is NULL and no error occurred, xrefs: 00007FFDFABD5AE1
O:CoReleaseMarshalData, xrefs: 00007FFDFABD5AB6
argument is not a COM object (got type=%s), xrefs: 00007FFDFABD5B2F
None is not a valid interface object in this context, xrefs: 00007FFDFABD5B0E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Err_$DeallocObject_$Arg_BuildDataErrorFormatFromInfoInstanceMarshalObjectOccurredParseReleaseStringTupleU_object@@Value
String ID: None is not a valid interface object in this context$O:CoReleaseMarshalData$The Python object is NULL and no error occurred$argument is not a COM object (got type=%s)
API String ID: 3327559703-3945113398
Opcode ID: abdfb4f8a74f480fa270a1b32874a538901005259450a12adb090c535eb655c0
Instruction ID: aae245d2144a7255b82121a12c051ce590cdde63c527bd5ca2f9980f23ee314c
Opcode Fuzzy Hash: abdfb4f8a74f480fa270a1b32874a538901005259450a12adb090c535eb655c0
Instruction Fuzzy Hash: F2411269B08A4291FB48DB59E86497D63A1FF88B84F9850B6DE2D87798DE3CE445C300

Function 00007FFDFAC14EF0 Relevance: 24.1, APIs: 16, Instructions: 141COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC14F39
PySequence_Check.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC14F6B
PySequence_Size.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC14F84
PyLong_FromSsize_t.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC14F9A
PyLong_FromLong.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC14FA6
PyDict_GetItem.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC14FB5
PyErr_Clear.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC14FC4
PyDict_SetItem.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC14FD3
_Py_Dealloc.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC14FEC
_Py_Dealloc.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC15005
PySequence_GetItem.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC15026
PyLong_AsSsize_t.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC15055
_Py_Dealloc.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC15077
_Py_Dealloc.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC15090
_Py_Dealloc.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC150B3
PyErr_Clear.PYTHON313(?,?,00000001,00007FFDFAC1516A), ref: 00007FFDFAC150C9

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Dealloc$ItemLong_Sequence_$ClearDict_Err_FromSsize_t$CheckLongSizeSubtypeType_
String ID:
API String ID: 1188691601-0
Opcode ID: 990299021235a1074c5ac790df30d5199ee65cf0a1ac59552841f35378b40761
Instruction ID: de6217dcee392e36f571729a3b3609b8e098c6f211e70df49978c5d6bf744bb0
Opcode Fuzzy Hash: 990299021235a1074c5ac790df30d5199ee65cf0a1ac59552841f35378b40761
Instruction Fuzzy Hash: 9E51403AF0960AA1FB5C5B659964A7D63D4AF45B90F0445B0CD3D427ECDF3DE4458380

Function 00007FFDFAC059F0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 117threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC05A0C
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC05A3B
?PyWinObject_AsDWORDArray@@YAHPEAU_object@@PEAPEAKPEAKH@Z.PYWINTYPES313 ref: 00007FFDFAC05A57
memset.VCRUNTIME140 ref: 00007FFDFAC05AA0
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC05AA5
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC05AC9
PyTuple_New.PYTHON313 ref: 00007FFDFAC05AEF
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC05B16
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC05B3D
CoTaskMemFree.OLE32 ref: 00007FFDFAC05B5C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFAC05B86

Strings

O:ReadPropertyNames, xrefs: 00007FFDFAC05A34
The Python object is invalid, xrefs: 00007FFDFAC059FE

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Object_ThreadU_object@@$Arg_Array@@DeallocErr_FreeFromParseRestoreSaveStringTaskTupleTuple_freememset
String ID: O:ReadPropertyNames$The Python object is invalid
API String ID: 3431620335-2841226944
Opcode ID: 263433a91e714c7f2e5b72a0961d4416ddcbff711c9cf93c7fde31f998eee1d9
Instruction ID: 80cf3faface6f284f0757ba488b373452608840357284965dce3fc650606e959
Opcode Fuzzy Hash: 263433a91e714c7f2e5b72a0961d4416ddcbff711c9cf93c7fde31f998eee1d9
Instruction Fuzzy Hash: 1F41C239B09B5683EB18DB51A4A487DA3A4FF84B90F088175DAAE977DCDE3CE440C700

Function 00007FFDFAC16C30 Relevance: 22.7, APIs: 15, Instructions: 234COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON313 ref: 00007FFDFAC16C6C
PyDict_New.PYTHON313 ref: 00007FFDFAC16C7A
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC16C96
PyErr_Clear.PYTHON313 ref: 00007FFDFAC16C9C
PyTuple_SetItem.PYTHON313 ref: 00007FFDFAC16D97
Py_BuildValue.PYTHON313 ref: 00007FFDFAC16DBC
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC16DD3
PyObject_CallObject.PYTHON313 ref: 00007FFDFAC16DDF
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC16DFB
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC16E14
PyTuple_Size.PYTHON313 ref: 00007FFDFAC16E41
PyTuple_GetItem.PYTHON313 ref: 00007FFDFAC16E55
PyTuple_Size.PYTHON313 ref: 00007FFDFAC16E6B
PyTuple_GetItem.PYTHON313 ref: 00007FFDFAC16E9D
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC16EF2

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Tuple_$Dealloc$Item$Size$BuildCallClearDict_Err_ObjectObject_Value
String ID:
API String ID: 2238649293-0
Opcode ID: 3463e2389ca444ec9eea0cb308954b7610305a20900ad4ee90f697cb1a6222e6
Instruction ID: 4a6bf13ae12fc2b67f5eae9896f1393e139348aa2f4b8647020c6e4971699f69
Opcode Fuzzy Hash: 3463e2389ca444ec9eea0cb308954b7610305a20900ad4ee90f697cb1a6222e6
Instruction Fuzzy Hash: E9919E3AB08B42A2EB189F11E964ABD63A5FF84BC4F448575D9AE477D8DE3CE445C300

Function 00007FFDFABF9A40 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 108threadCOMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABF9A52
PyObject_IsInstance.PYTHON313 ref: 00007FFDFABF9A8E
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF9AAB
CreateErrorInfo.OLEAUT32 ref: 00007FFDFABF9AB6
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF9AE1
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF9B06
SetErrorInfo.OLEAUT32 ref: 00007FFDFABF9B17
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF9B5C
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF9B90
PyGILState_Release.PYTHON313 ref: 00007FFDFABF9BAF

Strings

Clone, xrefs: 00007FFDFABF9A68
Could not convert the result from Next()/Clone() into the required COM interface, xrefs: 00007FFDFABF9B96

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Dealloc$ErrorEval_InfoState_Thread$CreateEnsureInstanceObject_ReleaseRestoreSave
String ID: Clone$Could not convert the result from Next()/Clone() into the required COM interface
API String ID: 333656411-380556627
Opcode ID: bec8c6c09c14300203f78fc9a07c0d696ba39e6edcfa94b1089576b44c30f484
Instruction ID: a5b2f9f1e6ba18a1b369df04252394884f1f8ce93c587958a3b4d8f31c5f6a05
Opcode Fuzzy Hash: bec8c6c09c14300203f78fc9a07c0d696ba39e6edcfa94b1089576b44c30f484
Instruction Fuzzy Hash: 57414F3AB08A47D2EB089F65D86497D63A0FB84B95F544472DE1E836ADDE3DD409C300

Function 00007FFDFAC17EE0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 105threadCOMMON

Download Yara Rule

APIs

?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC17F29
PyDict_GetItem.PYTHON313 ref: 00007FFDFAC17F53
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC17F6A
StringFromGUID2.OLE32 ref: 00007FFDFAC17F83
printf.MSPDB140-MSVCRT ref: 00007FFDFAC17F95
PyCapsule_IsValid.PYTHON313 ref: 00007FFDFAC17FD5
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC17FE9
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC1800E
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC18034
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC1804B

Part of subcall function 00007FFDFABC4250: PyErr_Occurred.PYTHON313 ref: 00007FFDFABC4259

Strings

Couldn't find IID %S, xrefs: 00007FFDFAC17F8E
win32com universal gateway, xrefs: 00007FFDFAC17FCB

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$FromRestoreSave$Capsule_D@@@DeallocDict_Err_ItemObject_OccurredStringU_object@@Validprintf
String ID: Couldn't find IID %S$win32com universal gateway
API String ID: 2453481656-3289595554
Opcode ID: 9d8deed0fb5ea0b3e7bf8d56ef260fc229cd7a1677dd9b5aceb49f82988de3cb
Instruction ID: b0e2098ce0bfd2aa632150c583ce79e2bf87615c52cdc3267417779bd6eb591d
Opcode Fuzzy Hash: 9d8deed0fb5ea0b3e7bf8d56ef260fc229cd7a1677dd9b5aceb49f82988de3cb
Instruction Fuzzy Hash: C1418069B09B4695FB289B12A864BBE63A0FF48B84F044474DE6E877DDDE3CE0418740

Function 00007FFDFABC7B30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABC7B76
PyObject_CallMethod.PYTHON313 ref: 00007FFDFABC7B98
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABC7BC1
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC7BE0
PyGILState_Release.PYTHON313 ref: 00007FFDFABC7C80

Strings

_GetTypeInfo_, xrefs: 00007FFDFABC7B8E
The Python object is invalid, xrefs: 00007FFDFABC7C12

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$Arg_CallDeallocEnsureMethodObject_ParseReleaseTuple
String ID: The Python object is invalid$_GetTypeInfo_
API String ID: 976812914-3895212227
Opcode ID: 6413ec627b45b174a35b0bdf3f99d74d7e02868e175a471f1b3b1c92cc061770
Instruction ID: 1c3335cd1ec0e2f9882fd402c93fe157311986a619ab9e3ff273c93a9622109f
Opcode Fuzzy Hash: 6413ec627b45b174a35b0bdf3f99d74d7e02868e175a471f1b3b1c92cc061770
Instruction Fuzzy Hash: 9D414C26B08A4292FB199B25E860E7963E0FF40B90F4550B2DA6D476E8DF3CE485C700

Function 00007FFDFABF0E60 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABF0E7C
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABF0EAF
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABF0EF3
PyErr_SetString.PYTHON313 ref: 00007FFDFABF0F1F

Part of subcall function 00007FFDFAC19E90: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDFABC2343), ref: 00007FFDFAC19EAA

_Py_NewReference.PYTHON313 ref: 00007FFDFABF0F6C
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF0F7F
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF0FA0
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF0FC0

Strings

td must be None, xrefs: 00007FFDFABF0F15
O:GetDataHere, xrefs: 00007FFDFABF0EA8
HOiii:FORMATETC, xrefs: 00007FFDFABF0EE7
The Python object is invalid, xrefs: 00007FFDFABF0E6E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Arg_Err_Eval_ParseStringThreadTuple$DeallocReferenceRestoreSavemalloc
String ID: HOiii:FORMATETC$O:GetDataHere$The Python object is invalid$td must be None
API String ID: 2083180792-977131618
Opcode ID: d1f78f3ad9244298d32882caeecb9d2c6b4f8b10e5308e57f42f1c9a01f4732a
Instruction ID: b3cffe56c8a981ab9e6c18b40c3167dd0cec381e81875ebb51a8cdf6badaced0
Opcode Fuzzy Hash: d1f78f3ad9244298d32882caeecb9d2c6b4f8b10e5308e57f42f1c9a01f4732a
Instruction Fuzzy Hash: EB413F36B08B8291EB54CB55F4546AE73E0FB84B84F944172DAAD43BA8EF3CE585C740

Function 00007FFDFAC05BA0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 93threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC05BBD
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC05BF2
?PyWinObject_AsDWORDArray@@YAHPEAU_object@@PEAPEAKPEAKH@Z.PYWINTYPES313 ref: 00007FFDFAC05C22
?PyWinObject_AsWCHARArray@@YAHPEAU_object@@PEAPEAPEA_WPEAKH@Z.PYWINTYPES313 ref: 00007FFDFAC05C3E
PyErr_SetString.PYTHON313 ref: 00007FFDFAC05C67
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC05C79
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC05C9F

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFAC05CE7
?PyWinObject_FreeWCHARArray@@YAXPEAPEA_WK@Z.PYWINTYPES313 ref: 00007FFDFAC05CF6

Strings

Property names must be a sequence the same size as property ids, xrefs: 00007FFDFAC05C5D
OO:WritePropertyNames, xrefs: 00007FFDFAC05BEB
The Python object is invalid, xrefs: 00007FFDFAC05BAF

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Object_RestoreSave$Array@@Err_U_object@@$DeallocString$Arg_BuildErrorFreeFromInfoObjectParseTupleValuefree
String ID: OO:WritePropertyNames$Property names must be a sequence the same size as property ids$The Python object is invalid
API String ID: 1119876306-2196422330
Opcode ID: 33265b365198fb450d7f49ccfd9e6a30e0b51f29887dad866814347ad1808e31
Instruction ID: 14fd5b3bb08533cbd464d244551fe556feca6866fd44b1fb9a662c8c23db517c
Opcode Fuzzy Hash: 33265b365198fb450d7f49ccfd9e6a30e0b51f29887dad866814347ad1808e31
Instruction Fuzzy Hash: A3413039B08B5686FB149F15E46097D63B4FB88B80F588072DA5D876ACDF3CE445CB00

Function 00007FFDFABC6C30 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABC6C79
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABC6C86
?PyWinObject_FromFILETIME@@YAPEAU_object@@AEBU_FILETIME@@@Z.PYWINTYPES313 ref: 00007FFDFABC6C93
?PyWinObject_FromFILETIME@@YAPEAU_object@@AEBU_FILETIME@@@Z.PYWINTYPES313 ref: 00007FFDFABC6CA0
?PyWinObject_FromFILETIME@@YAPEAU_object@@AEBU_FILETIME@@@Z.PYWINTYPES313 ref: 00007FFDFABC6CAD
Py_BuildValue.PYTHON313 ref: 00007FFDFABC6CD6
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC6CF3
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC6D13
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC6D31
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC6D4F
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC6D6D

Strings

OOiOOO, xrefs: 00007FFDFABC6CB7

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: DeallocFromObject_U_object@@$E@@@$D@@@$BuildValue
String ID: OOiOOO
API String ID: 264182150-956672829
Opcode ID: 58f1add5ca0725387a7286ec870eec7b499544ffa67c58a8ceaa26ed65058350
Instruction ID: 63fdd0e71d328df903a59150b49d9a44843d978c9a95206ed90ad2d7fef550ce
Opcode Fuzzy Hash: 58f1add5ca0725387a7286ec870eec7b499544ffa67c58a8ceaa26ed65058350
Instruction Fuzzy Hash: 65414936B09A0286EB5A9F21A478E7873A0FB45B84F4954B5CA6D43BE8DF3CE051C700

Function 00007FFDFABC6920 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 77timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABC699E
?PyWinObject_AsULARGE_INTEGER@@YAHPEAU_object@@PEAT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FFDFABC69BC
?PyWinTime_Check@@YAHPEAU_object@@@Z.PYWINTYPES313 ref: 00007FFDFABC69D2
?PyWinTime_Check@@YAHPEAU_object@@@Z.PYWINTYPES313 ref: 00007FFDFABC69E8
?PyWinTime_Check@@YAHPEAU_object@@@Z.PYWINTYPES313 ref: 00007FFDFABC69F7
?PyWinObject_AsFILETIME@@YAHPEAU_object@@PEAU_FILETIME@@@Z.PYWINTYPES313 ref: 00007FFDFABC6A0D
?PyWinObject_AsFILETIME@@YAHPEAU_object@@PEAU_FILETIME@@@Z.PYWINTYPES313 ref: 00007FFDFABC6A23
?PyWinObject_AsFILETIME@@YAHPEAU_object@@PEAU_FILETIME@@@Z.PYWINTYPES313 ref: 00007FFDFABC6A36
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABC6A4C
PyErr_SetString.PYTHON313 ref: 00007FFDFABC6A75

Strings

The time entries in a STATSTG tuple must be PyDateTime objects, xrefs: 00007FFDFABC6A6B
ziOOOOiiOii, xrefs: 00007FFDFABC6973

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Object_U_object@@$Check@@E@@@Time_U_object@@@$Arg_D@@@Err_ParseR@@@StringTuple
String ID: The time entries in a STATSTG tuple must be PyDateTime objects$ziOOOOiiOii
API String ID: 75234034-3621292200
Opcode ID: 962d1e5a9d51b565be96d9149d6b22caff4fadba4044cd296bd95abef1fb7871
Instruction ID: 4e8af37a3b0f6f6b401a3332638e1c5cf18951fb33cdd913084f67a50f96573e
Opcode Fuzzy Hash: 962d1e5a9d51b565be96d9149d6b22caff4fadba4044cd296bd95abef1fb7871
Instruction Fuzzy Hash: EF413076708F8295EB648F21E4A0BAA73B4FB84B80F449075DA9D836ACDF3CD559C700

Function 00007FFDFAC0BB70 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 113threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC0BB91
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC0BBE4
?PyWinObject_AsFILETIME@@YAHPEAU_object@@PEAU_FILETIME@@@Z.PYWINTYPES313 ref: 00007FFDFAC0BC13
?PyWinObject_AsFILETIME@@YAHPEAU_object@@PEAU_FILETIME@@@Z.PYWINTYPES313 ref: 00007FFDFAC0BC42
?PyWinObject_AsFILETIME@@YAHPEAU_object@@PEAU_FILETIME@@@Z.PYWINTYPES313 ref: 00007FFDFAC0BC6B
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFAC0BC93
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0BC9D
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0BCC5
PyMem_Free.PYTHON313 ref: 00007FFDFAC0BD06

Strings

OOOO:SetElementTimes, xrefs: 00007FFDFAC0BBDA
The Python object is invalid, xrefs: 00007FFDFAC0BB83

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Object_U_object@@$E@@@$Eval_Thread$Arg_Err_FreeMem_ParseRestoreSaveStringTuple
String ID: OOOO:SetElementTimes$The Python object is invalid
API String ID: 241530360-3632606313
Opcode ID: e45c3194c55181bce4ada4a275550d34c5edcae9b3025a4c2ba395116f200bb5
Instruction ID: 0004093d9fea0df0bbdd31432273d046f7ce41b115eb4c71e33a79b9f4bd7b03
Opcode Fuzzy Hash: e45c3194c55181bce4ada4a275550d34c5edcae9b3025a4c2ba395116f200bb5
Instruction Fuzzy Hash: 2A413F2AB19A5291EB18CB15E460ABE63A0FF85B90F4840B5DE6E837ECDF3CD445C700

Function 00007FFDFABFA990 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 111threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABFA9B4
PyErr_SetString.PYTHON313 ref: 00007FFDFABFA9D1
memset.VCRUNTIME140 ref: 00007FFDFABFAA2C
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABFAA31
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABFAA55
PyTuple_New.PYTHON313 ref: 00007FFDFABFAA7A
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABFAAA6
_Py_Dealloc.PYTHON313 ref: 00007FFDFABFAAC9
CoTaskMemFree.OLE32 ref: 00007FFDFABFAAEB

Strings

|I:Next, xrefs: 00007FFDFABFA9AD
The Python object is invalid, xrefs: 00007FFDFABFA9C3

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_DeallocErr_FreeFromObject_ParseRestoreSaveStringTaskTupleTuple_U_object@@memset
String ID: The Python object is invalid$|I:Next
API String ID: 1381306868-958815924
Opcode ID: 2fa85a62bcbe94d1452b09e4bea2465e5e9586dacfbcf71472eaac91e9ee1903
Instruction ID: e31b159cf80b9e0b449704df9bc73b82dcd20ffc1eff5db0cf053c592a673daa
Opcode Fuzzy Hash: 2fa85a62bcbe94d1452b09e4bea2465e5e9586dacfbcf71472eaac91e9ee1903
Instruction Fuzzy Hash: EC41B239B19AC282EB0C8B95A46497DA3A1FF88B94F484179DA6D477DCDF3CE445C700

Function 00007FFDFABF1EB0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABF1ED3
Py_BuildValue.PYTHON313 ref: 00007FFDFABF1EFF
PyErr_Occurred.PYTHON313 ref: 00007FFDFABF1F24
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF1F89
PyErr_Occurred.PYTHON313 ref: 00007FFDFABF1FDD
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF201B
PyGILState_Release.PYTHON313 ref: 00007FFDFABF2024

Strings

Hziii, xrefs: 00007FFDFABF1EDD
Unexpected exception in gateway method '%hs', xrefs: 00007FFDFABF1F3F, 00007FFDFABF1FF5
(O), xrefs: 00007FFDFABF1F5A
GetDataHere, xrefs: 00007FFDFABF1F36, 00007FFDFABF1F6B, 00007FFDFABF1FEC

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: DeallocErr_OccurredState_$BuildEnsureReleaseValue
String ID: (O)$GetDataHere$Hziii$Unexpected exception in gateway method '%hs'
API String ID: 3545230104-215289106
Opcode ID: b969598cbdc5abae08448a14be90388e3937f59abd74143b50cbdefcad8ee9fe
Instruction ID: 0ca5423ef7e1ce7b1f3a01b6c58c50067f7101072db67c541619673424920f68
Opcode Fuzzy Hash: b969598cbdc5abae08448a14be90388e3937f59abd74143b50cbdefcad8ee9fe
Instruction Fuzzy Hash: 7541A836B1874295E7598F64E8609BD63A0FF48B84F854071EE2E476D9EF3CE544C300

Function 00007FFDFAC0BA00 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC0BA25
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0BA54

Strings

OO:RenameElement, xrefs: 00007FFDFAC0BA76
The Python object is invalid, xrefs: 00007FFDFAC0BA17

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: OO:RenameElement$The Python object is invalid
API String ID: 1450464846-4064606997
Opcode ID: 6168186f1fbb40e5a6be7c14385c815ac862745ede3bd0eca3957e536cb9ca21
Instruction ID: 8b25117b67dfd62d43bb55e902e0bddb84a715e1dd54adfa9c64993301f21292
Opcode Fuzzy Hash: 6168186f1fbb40e5a6be7c14385c815ac862745ede3bd0eca3957e536cb9ca21
Instruction Fuzzy Hash: B2410F39B08A5282FB54DB25E46097E63A1FF88FD4B485571DAAE937ACDE2CE441C700

Function 00007FFDFABD2B60 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 70libraryloaderCOMMON

Download Yara Rule

APIs

PyErr_Clear.PYTHON313 ref: 00007FFDFABD2B70
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABD2B85
GetModuleHandleW.KERNEL32 ref: 00007FFDFABD2BB3
GetProcAddress.KERNEL32 ref: 00007FFDFABD2BC8
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABD2BF6
Py_BuildValue.PYTHON313 ref: 00007FFDFABD2C1A
_Py_Dealloc.PYTHON313 ref: 00007FFDFABD2C31
_Py_Dealloc.PYTHON313 ref: 00007FFDFABD2C53

Strings

CoInitializeEx, xrefs: 00007FFDFABD2BBE
OOiO, xrefs: 00007FFDFABD2C03
ole32.dll, xrefs: 00007FFDFABD2BAC

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Dealloc$AddressArg_BuildClearD@@@Err_FromHandleModuleObject_ParseProcTupleU_object@@Value
String ID: CoInitializeEx$OOiO$ole32.dll
API String ID: 3239830637-2671725199
Opcode ID: d4806bb4be3b53c637ee2c6dad951a6d8f435bb8f24ae285639a4429b9007c09
Instruction ID: 30ab466c6ac3f827caa4f99bad1e322f7f1faa6e7b9e275cb28eb5fd59b9ea90
Opcode Fuzzy Hash: d4806bb4be3b53c637ee2c6dad951a6d8f435bb8f24ae285639a4429b9007c09
Instruction Fuzzy Hash: 49314139B0DA4292EB089F25E864AB963E0FF49B90F4805B5D96E877DCDF3DE4458700

Function 00007FFDFAC09A30 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFAC09A7F
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC09B0A
PyErr_Occurred.PYTHON313 ref: 00007FFDFAC09B28
PyGILState_Release.PYTHON313 ref: 00007FFDFAC09C10

Part of subcall function 00007FFDFABC4BF0: PyErr_Fetch.PYTHON313 ref: 00007FFDFABC4C21
Part of subcall function 00007FFDFABC4BF0: PyErr_NormalizeException.PYTHON313 ref: 00007FFDFABC4C40
Part of subcall function 00007FFDFABC4BF0: PyErr_GivenExceptionMatches.PYTHON313 ref: 00007FFDFABC4C55
Part of subcall function 00007FFDFABC4BF0: PyErr_Restore.PYTHON313 ref: 00007FFDFABC4C7A

Part of subcall function 00007FFDFABC4250: PyErr_Occurred.PYTHON313 ref: 00007FFDFABC4259

Strings

Unexpected exception in gateway method '%hs', xrefs: 00007FFDFAC09B43, 00007FFDFAC09BA4
kkOkkk, xrefs: 00007FFDFAC09AF9
QueryBlanket, xrefs: 00007FFDFAC09AB5, 00007FFDFAC09B3A, 00007FFDFAC09B9B

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$ExceptionOccurredState_$Arg_EnsureFetchGivenMatchesNormalizeParseReleaseRestoreTuple
String ID: QueryBlanket$Unexpected exception in gateway method '%hs'$kkOkkk
API String ID: 2789434422-1352019005
Opcode ID: 6b13fd045abd9acde16488a9ac61611e2e9d76c667b4bf175f81d201416ecd16
Instruction ID: 8efdb4e38715647cb5208d2de123df749299cb75c895dbb7bf59f58c715d5b10
Opcode Fuzzy Hash: 6b13fd045abd9acde16488a9ac61611e2e9d76c667b4bf175f81d201416ecd16
Instruction Fuzzy Hash: 4451503AB09A5286EB188F15E460B6E73B0FB85794F448171DEAD87798DF3CD405CB00

Function 00007FFDFABC6A90 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABC6ADC
PyTuple_New.PYTHON313 ref: 00007FFDFABC6B2C
PyArg_ParseTupleAndKeywords.PYTHON313 ref: 00007FFDFABC6B6C
PyMem_Free.PYTHON313 ref: 00007FFDFABC6B81
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC6BCE
PyErr_Clear.PYTHON313 ref: 00007FFDFABC6BDD
PyErr_SetString.PYTHON313 ref: 00007FFDFABC6BF4

Strings

STGOPTIONS must be a dictionary containing {Version:int,reserved:0,SectorSize:int,TemplateFile:unicode}, xrefs: 00007FFDFABC6AD2, 00007FFDFABC6BEA
|lllU, xrefs: 00007FFDFABC6B65

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$String$Arg_ClearDeallocFreeKeywordsMem_ParseTupleTuple_
String ID: STGOPTIONS must be a dictionary containing {Version:int,reserved:0,SectorSize:int,TemplateFile:unicode}$|lllU
API String ID: 4063213528-4198855380
Opcode ID: dddc75488027573a66ab4b753f57d27e87d30f3c202d0bc1dc4a874c046360ff
Instruction ID: 6d6c8160d471f932589807e4e90b010e620a3067546731987d24bc47dbc0f4f1
Opcode Fuzzy Hash: dddc75488027573a66ab4b753f57d27e87d30f3c202d0bc1dc4a874c046360ff
Instruction Fuzzy Hash: C9415936708B4285EB19DF19E8A097DB3E4FB88B84F458076DAAD837A8DE3CD455C300

Function 00007FFDFABFAE60 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABFAE7D
memset.VCRUNTIME140 ref: 00007FFDFABFAEC8
PySequence_Tuple.PYTHON313 ref: 00007FFDFABFAED2
PyErr_Format.PYTHON313 ref: 00007FFDFABFAF1F

Part of subcall function 00007FFDFABC4250: PyErr_Occurred.PYTHON313 ref: 00007FFDFABC4259

_Py_Dealloc.PYTHON313 ref: 00007FFDFABFAF41
?PyWinObject_FreeTaskAllocatedWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFABFAF6F
?PyWinObject_AsTaskAllocatedWCHAR@@YAHPEAU_object@@PEAPEA_WH@Z.PYWINTYPES313 ref: 00007FFDFABFAF9E
PyGILState_Release.PYTHON313 ref: 00007FFDFABFAFCD

Strings

Next, xrefs: 00007FFDFABFAE9F
Received %d items , but only %d items requested, xrefs: 00007FFDFABFAF0F

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: AllocatedErr_Object_State_Task$DeallocEnsureFormatFreeOccurredReleaseSequence_TupleU_object@@memset
String ID: Next$Received %d items , but only %d items requested
API String ID: 4242019863-38368155
Opcode ID: 885763fc19cd07d693e57fef543984687db979c46616e017d75547e96541494a
Instruction ID: 8e6280651631df902c351c2d30c8962ed58bf39780d77497d4d842de99f2da01
Opcode Fuzzy Hash: 885763fc19cd07d693e57fef543984687db979c46616e017d75547e96541494a
Instruction Fuzzy Hash: 4241AF7AB29B8296E7189F65E46097DA3A0FB44784F484075DE6E8B7E8DF3CE444C700

Function 00007FFDFABEE910 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 84threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABEE92D
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABEE96C
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFABEE98B
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFABEE9A8
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABEE9BF
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABEE9E8
SysFreeString.OLEAUT32 ref: 00007FFDFABEE9F3
SysFreeString.OLEAUT32 ref: 00007FFDFABEE9FE

Strings

iOO:DefineFuncAsDllEntry, xrefs: 00007FFDFABEE965
The Python object is invalid, xrefs: 00007FFDFABEE91F

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: String$Bstr@@Eval_FreeObject_ThreadU_object@@$Arg_Err_ParseRestoreSaveTuple
String ID: The Python object is invalid$iOO:DefineFuncAsDllEntry
API String ID: 1484531722-2296264261
Opcode ID: 24cb53ed7f5384d02be4c2f221b9663f9e1c51ee7173658ed6e63ba132290a09
Instruction ID: 3fb1824d6fb9d80436dcb9e0b2291f0a7973873a743b98c31cba6cb83019cd7f
Opcode Fuzzy Hash: 24cb53ed7f5384d02be4c2f221b9663f9e1c51ee7173658ed6e63ba132290a09
Instruction Fuzzy Hash: B7313279B18A4292FB099B25E864A7E63A0FF84B90F841076DE5D477A8DF7CD845C700

Function 00007FFDFAC0DF10 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC0DF41
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0DF65

Strings

|i:Stat, xrefs: 00007FFDFAC0DF7F
The Python object is invalid, xrefs: 00007FFDFAC0DF3A

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$|i:Stat
API String ID: 1450464846-438154399
Opcode ID: 27182215e442f91bd1e3aac620819bce5c108dfdf1a9d6090c829e0d71768f4b
Instruction ID: 6e76622b43c0e3f9efd847a94c8f9ea4c3cee489e879eebf6da5a2c7619776c2
Opcode Fuzzy Hash: 27182215e442f91bd1e3aac620819bce5c108dfdf1a9d6090c829e0d71768f4b
Instruction Fuzzy Hash: 49313269B1C69281FB699B21E824B7D63A1FF44B84F4844B1D96E877DCDF2CE5048700

Function 00007FFDFAC14915 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC1492A
PyDict_GetItem.PYTHON313 ref: 00007FFDFAC14946
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC1495C
PyErr_Clear.PYTHON313 ref: 00007FFDFAC14967
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFAC14980
PyErr_SetString.PYTHON313 ref: 00007FFDFAC149B0
VariantClear.OLEAUT32 ref: 00007FFDFAC14B36

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFAC1499F
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFAC1498A
There is no interface object registered that supports this IID, xrefs: 00007FFDFAC1496D

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: ClearErr_Object_$D@@@DeallocDict_FromItemStringSubclassU_object@@Variant
String ID: The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 592232323-49823770
Opcode ID: 24807c69ac57358af63bd308781007d789a951bedb9c11460da040fe214732d4
Instruction ID: ced2286691dc33ff00f8d5b523c71b664e7f7ba3987718c2806ca122e348e80b
Opcode Fuzzy Hash: 24807c69ac57358af63bd308781007d789a951bedb9c11460da040fe214732d4
Instruction Fuzzy Hash: 2E310B79B09A42A1FB59DB16E964A7C23A5BF49B84F4884B1CD6D437DCEF3CE5068300

Function 00007FFDFAC149FE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC149B0
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC14A0F
PyDict_GetItem.PYTHON313 ref: 00007FFDFAC14A2B
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC14A41
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFAC14A5A
VariantClear.OLEAUT32 ref: 00007FFDFAC14B36

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFAC1499F
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFAC1498A
There is no interface object registered that supports this IID, xrefs: 00007FFDFAC1496D

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Object_$ClearD@@@DeallocDict_Err_FromItemStringSubclassU_object@@Variant
String ID: The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 4055360134-49823770
Opcode ID: dd3cbd90fd24482837ed38d7d0d8512a03e371dbbbde1d708f42175be810563a
Instruction ID: a01ca16744d8a447e1fe742592541aadaee3930fa14b3b12ed0ba58875b81c01
Opcode Fuzzy Hash: dd3cbd90fd24482837ed38d7d0d8512a03e371dbbbde1d708f42175be810563a
Instruction Fuzzy Hash: 4521F97DB08A42A1FB69DB15E964A7C23A5BF49B84F4884B1CD6D477DCEE3CE4458300

Function 00007FFDFABD2F40 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 47COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABD2F53
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABD2FA1

Strings

FACILITY_EDB, xrefs: 00007FFDFABD2FBE
<Unknown Facility>, xrefs: 00007FFDFABD2F9A
FACILITY_MDSI, xrefs: 00007FFDFABD2FAC
FACILITY_BACKUP, xrefs: 00007FFDFABD2FD0

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Arg_FromObject_ParseTupleU_object@@
String ID: <Unknown Facility>$FACILITY_BACKUP$FACILITY_EDB$FACILITY_MDSI
API String ID: 1545321530-3847080442
Opcode ID: 048f06e120f84a255e64444fa389d0ecc3cc1d819bca89119e7a47716cb145d6
Instruction ID: 1763b1cb3dce3fe00b58020b3bd5f6af1499b89e0f8431ea530533a78fa85073
Opcode Fuzzy Hash: 048f06e120f84a255e64444fa389d0ecc3cc1d819bca89119e7a47716cb145d6
Instruction Fuzzy Hash: 4E114C79F1884291FB0C9B19DCB5AB86261FF94745FC804F5D62E816E8CE2CA59A8704

Function 00007FFDFAC0E940 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 113threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0E97A
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0E997
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0EADF

Strings

The Python object is invalid, xrefs: 00007FFDFAC0EAD1

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSaveString
String ID: The Python object is invalid
API String ID: 695671107-2445808733
Opcode ID: fb0fbe658c8802958a6930a3b7768fa9a8fd7267b6750583ea1c1e8daffe2702
Instruction ID: c2a5941642df8f94062bad0a6010c8590ce18815c946c9cea3752941a9b6d014
Opcode Fuzzy Hash: fb0fbe658c8802958a6930a3b7768fa9a8fd7267b6750583ea1c1e8daffe2702
Instruction Fuzzy Hash: 5551167AB09A1196E798CF2AE55057D77B0FB48B84B044076EB5D93B98DF3CE4A1CB00

Function 00007FFDFAC03A20 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFAC03A46
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC03A52
PyErr_Occurred.PYTHON313 ref: 00007FFDFAC03A77
PyErr_Occurred.PYTHON313 ref: 00007FFDFAC03B1F
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC03B5D

Part of subcall function 00007FFDFABC4BF0: PyErr_Fetch.PYTHON313 ref: 00007FFDFABC4C21
Part of subcall function 00007FFDFABC4BF0: PyErr_NormalizeException.PYTHON313 ref: 00007FFDFABC4C40
Part of subcall function 00007FFDFABC4BF0: PyErr_GivenExceptionMatches.PYTHON313 ref: 00007FFDFABC4C55
Part of subcall function 00007FFDFABC4BF0: PyErr_Restore.PYTHON313 ref: 00007FFDFABC4C7A

Part of subcall function 00007FFDFABC4250: PyErr_Occurred.PYTHON313 ref: 00007FFDFABC4259

_Py_Dealloc.PYTHON313 ref: 00007FFDFAC03B71
PyGILState_Release.PYTHON313 ref: 00007FFDFAC03B7A

Strings

Unexpected exception in gateway method '%hs', xrefs: 00007FFDFAC03A8F, 00007FFDFAC03B37
Open, xrefs: 00007FFDFAC03A86, 00007FFDFAC03AC7, 00007FFDFAC03B2E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$Occurred$DeallocExceptionState_$D@@@EnsureFetchFromGivenMatchesNormalizeObject_ReleaseRestoreU_object@@
String ID: Open$Unexpected exception in gateway method '%hs'
API String ID: 2391609008-3017595499
Opcode ID: f82398628ab3b14e29eb950cf320870efba784f57a9934f1e78bb9318afc7e14
Instruction ID: 15b6092d797e9076a2a67c12705dec7b07a249579dceae842b59ece8a4f7a7a9
Opcode Fuzzy Hash: f82398628ab3b14e29eb950cf320870efba784f57a9934f1e78bb9318afc7e14
Instruction Fuzzy Hash: FD41863AB1864791FB589B25E824ABD73A1FF44B94F4880B1D96E877D9EE3CE505C300

Function 00007FFDFABF7B50 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABF7B74
PyErr_SetString.PYTHON313 ref: 00007FFDFABF7B91
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF7BDA
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF7BFE
PyTuple_New.PYTHON313 ref: 00007FFDFABF7C35
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABF7C70
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF7C92

Strings

|l:Next, xrefs: 00007FFDFABF7B6D
The Python object is invalid, xrefs: 00007FFDFABF7B83

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_D@@@DeallocErr_FromObject_ParseRestoreSaveStringTupleTuple_U_object@@
String ID: The Python object is invalid$|l:Next
API String ID: 770659799-1850198577
Opcode ID: 85796f223008af7dbd0982bd3f23eb1b2cb199264c397eef453f94ae485d8573
Instruction ID: 7d711de50ee1e60b38da67f9bf74217f5bfb98c7f301d01e180c42b476ef872a
Opcode Fuzzy Hash: 85796f223008af7dbd0982bd3f23eb1b2cb199264c397eef453f94ae485d8573
Instruction Fuzzy Hash: 4F41B229B08A8282EB089F51A460A7D63B1FF88B94F4845B1DE6D473D8DF3CE485C300

Function 00007FFDFABE7B00 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABE7B21
PyArg_Parse.PYTHON313 ref: 00007FFDFABE7B73
PyErr_Occurred.PYTHON313 ref: 00007FFDFABE7B91
PyGILState_Release.PYTHON313 ref: 00007FFDFABE7C39

Strings

Unexpected exception in gateway method '%hs', xrefs: 00007FFDFABE7BAC, 00007FFDFABE7C0B
<unknown>, xrefs: 00007FFDFABE7BA3
Clone, xrefs: 00007FFDFABE7B45, 00007FFDFABE7C02

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$Arg_EnsureErr_OccurredParseRelease
String ID: <unknown>$Clone$Unexpected exception in gateway method '%hs'
API String ID: 1808086756-160319612
Opcode ID: 50137d5b2ae5c6f70d0ae6475f813d42714069487d7050b465e02c15590b5e08
Instruction ID: ba8237beaf3330bb21b3945ccc8744882fa911827a4b447021d990d617f67fa5
Opcode Fuzzy Hash: 50137d5b2ae5c6f70d0ae6475f813d42714069487d7050b465e02c15590b5e08
Instruction Fuzzy Hash: 9441C535B0864792EB189B25E8B4ABD23A0FF44B94F8440B1CE6E477DDEE2CE545C340

Function 00007FFDFABFD930 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABFD953
PyArg_Parse.PYTHON313 ref: 00007FFDFABFD9A0
PyErr_Occurred.PYTHON313 ref: 00007FFDFABFD9BE
PyErr_Occurred.PYTHON313 ref: 00007FFDFABFDA19
_Py_Dealloc.PYTHON313 ref: 00007FFDFABFDA57
PyGILState_Release.PYTHON313 ref: 00007FFDFABFDA60

Strings

Unexpected exception in gateway method '%hs', xrefs: 00007FFDFABFD9D9, 00007FFDFABFDA31
<unknown>, xrefs: 00007FFDFABFD9D0, 00007FFDFABFDA28
Stat, xrefs: 00007FFDFABFD974

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_OccurredState_$Arg_DeallocEnsureParseRelease
String ID: <unknown>$Stat$Unexpected exception in gateway method '%hs'
API String ID: 3280672200-2095743813
Opcode ID: 09d9dbc4c92a8a9f41c625411d1195270e1c666c83debe959f6f97d87a704ccf
Instruction ID: eb06d09403aef465e54f790261d5b3c00f7d8c302bd5ad0a583f9777827f0b2a
Opcode Fuzzy Hash: 09d9dbc4c92a8a9f41c625411d1195270e1c666c83debe959f6f97d87a704ccf
Instruction Fuzzy Hash: F831B625B0868281FB589B65E824ABD63A0FF45B98F845072DE7E876D9EE7CE005C340

Function 00007FFDFABE79B0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABE79D3
PyArg_Parse.PYTHON313 ref: 00007FFDFABE7A20
PyErr_Occurred.PYTHON313 ref: 00007FFDFABE7A3E
PyErr_Occurred.PYTHON313 ref: 00007FFDFABE7A99
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE7AD7
PyGILState_Release.PYTHON313 ref: 00007FFDFABE7AE0

Strings

Unexpected exception in gateway method '%hs', xrefs: 00007FFDFABE7A59, 00007FFDFABE7AB1
<unknown>, xrefs: 00007FFDFABE7A50
Stat, xrefs: 00007FFDFABE79F4, 00007FFDFABE7AA8

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_OccurredState_$Arg_DeallocEnsureParseRelease
String ID: <unknown>$Stat$Unexpected exception in gateway method '%hs'
API String ID: 3280672200-2095743813
Opcode ID: b5260f2896d5111789d884c21231ebcd486bd69b382e3542d7825aa602637b14
Instruction ID: e6646169072e3692efac6419b05743641e695b27c5c6d652ff3406e520fa1543
Opcode Fuzzy Hash: b5260f2896d5111789d884c21231ebcd486bd69b382e3542d7825aa602637b14
Instruction Fuzzy Hash: 6F31B539B0868691FB589B25E864DBD63A0FF44B94F845072DE3E876D9EE3CE545C300

Function 00007FFDFABE99E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

PySequence_Check.PYTHON313 ref: 00007FFDFABE99F3
PyErr_SetString.PYTHON313 ref: 00007FFDFABE9A0E
PyObject_Size.PYTHON313 ref: 00007FFDFABE9A3B
PySequence_GetItem.PYTHON313 ref: 00007FFDFABE9A7C
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABE9A90
PyErr_SetString.PYTHON313 ref: 00007FFDFABE9AAB
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE9AC1

Strings

Object must be a sequence of CATIDs, xrefs: 00007FFDFABE9A04
CATID is not valid, xrefs: 00007FFDFABE9AA1

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_Object_Sequence_String$CheckD@@@DeallocItemSizeU_object@@
String ID: CATID is not valid$Object must be a sequence of CATIDs
API String ID: 3435976531-1565270022
Opcode ID: 9a1861bb7aba934d31553a12fd06f472d323afa17d328e4b991c3643cc4504e1
Instruction ID: e0cc22aad3211c32dfa74f37de459c77245bf57b92dfd8f229d8de54ccba9a12
Opcode Fuzzy Hash: 9a1861bb7aba934d31553a12fd06f472d323afa17d328e4b991c3643cc4504e1
Instruction Fuzzy Hash: 4231AF29B08B8681EB189B16A864939B3E4FF84F94F840575DE6D87BD8DE7CE455C300

Function 00007FFDFAC0B8D0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC0B8F5
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0B924

Strings

O:DestroyElement, xrefs: 00007FFDFAC0B941
The Python object is invalid, xrefs: 00007FFDFAC0B8E7

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: O:DestroyElement$The Python object is invalid
API String ID: 1450464846-3564787880
Opcode ID: 7e5c85f843a68c7219634350855d3d65e638f2bba635a558cd3caab827ab1134
Instruction ID: bfa7204901f057f7051da86fd1e124a5796565c0b1fb335d8aaed978272b5bf3
Opcode Fuzzy Hash: 7e5c85f843a68c7219634350855d3d65e638f2bba635a558cd3caab827ab1134
Instruction Fuzzy Hash: 8D314D69B08B5282EB09DB5AF46057E63B0FF48BD4B484072DE6E9379CDE2CE441C700

Function 00007FFDFAC11BE0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON313 ref: 00007FFDFAC11C23

Part of subcall function 00007FFDFAC11BE0: PyTuple_SetItem.PYTHON313 ref: 00007FFDFAC11C3C
Part of subcall function 00007FFDFAC11BE0: Py_BuildValue.PYTHON313 ref: 00007FFDFAC11C5F
Part of subcall function 00007FFDFAC11BE0: PyTuple_SetItem.PYTHON313 ref: 00007FFDFAC11C6E

PyLong_FromLong.PYTHON313 ref: 00007FFDFAC11C97
Py_BuildValue.PYTHON313 ref: 00007FFDFAC11CC4
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC11CDB

Strings

(iO), xrefs: 00007FFDFAC11CBA
(ii), xrefs: 00007FFDFAC11C54

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Tuple_$BuildItemValue$DeallocFromLongLong_
String ID: (iO)$(ii)
API String ID: 2956700472-1646815443
Opcode ID: 2b0ad28aa4c4a31c7926f68112ac9837f79cfb720b9e0fc0993aef3ebff6fac3
Instruction ID: 09dad6f8b33af53360010f598b53c8183a96e51216a3c19d213f1ec21ae01c6e
Opcode Fuzzy Hash: 2b0ad28aa4c4a31c7926f68112ac9837f79cfb720b9e0fc0993aef3ebff6fac3
Instruction Fuzzy Hash: FB314A3AB08642D6EB189F26A4609BD63A1FF44FC4B444075EB6E47698DF3DE4929700

Function 00007FFDFABFCC00 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 71threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABFCC1C
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABFCC50
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFDFABFCC60
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABFCC7A
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABFCCAF
_Py_Dealloc.PYTHON313 ref: 00007FFDFABFCCCE
_PyBytes_Resize.PYTHON313 ref: 00007FFDFABFCCF9

Strings

Kk:ReadAt, xrefs: 00007FFDFABFCC49
The Python object is invalid, xrefs: 00007FFDFABFCC0E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Bytes_Eval_StringThread$Arg_DeallocErr_FromParseResizeRestoreSaveSizeTuple
String ID: Kk:ReadAt$The Python object is invalid
API String ID: 2020974559-1841062213
Opcode ID: 42c4757f5566b1af680a50b05448942146a76c4d9db34fe8f7bd781888aa154f
Instruction ID: fe0a15c36bb02194b8f9c3ca9ba0d3b0fc4ae66cdc7d8a50c0148c8fd5af4436
Opcode Fuzzy Hash: 42c4757f5566b1af680a50b05448942146a76c4d9db34fe8f7bd781888aa154f
Instruction Fuzzy Hash: 04312035B08A4682FB088B69F46496E73A1FB45B94F940171DA6D577ACDF3CE481CB40

Function 00007FFDFAC00A70 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFAC00A91
PyArg_Parse.PYTHON313 ref: 00007FFDFAC00AD5
?PyWinObject_AsTaskAllocatedWCHAR@@YAHPEAU_object@@PEAPEA_WH@Z.PYWINTYPES313 ref: 00007FFDFAC00AEA

Part of subcall function 00007FFDFABC4BF0: PyErr_Fetch.PYTHON313 ref: 00007FFDFABC4C21
Part of subcall function 00007FFDFABC4BF0: PyErr_NormalizeException.PYTHON313 ref: 00007FFDFABC4C40
Part of subcall function 00007FFDFABC4BF0: PyErr_GivenExceptionMatches.PYTHON313 ref: 00007FFDFABC4C55
Part of subcall function 00007FFDFABC4BF0: PyErr_Restore.PYTHON313 ref: 00007FFDFABC4C7A

Part of subcall function 00007FFDFABC4250: PyErr_Occurred.PYTHON313 ref: 00007FFDFABC4259

PyErr_Occurred.PYTHON313 ref: 00007FFDFAC00B08
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC00B46
PyGILState_Release.PYTHON313 ref: 00007FFDFAC00B4E

Strings

Unexpected exception in gateway method '%hs', xrefs: 00007FFDFAC00B20
<unknown>, xrefs: 00007FFDFAC00B17
GetCurFile, xrefs: 00007FFDFAC00AA4

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$ExceptionOccurredState_$AllocatedArg_DeallocEnsureFetchGivenMatchesNormalizeObject_ParseReleaseRestoreTaskU_object@@
String ID: <unknown>$GetCurFile$Unexpected exception in gateway method '%hs'
API String ID: 605707310-4081849276
Opcode ID: b076ad593769f706d535175aa7115e37a110d57c25e6c28f7bf4ed710d338876
Instruction ID: b82268474b5770f0d56c57b8fb839c2bbd992d7960371e12f0a4a4ba283d75fa
Opcode Fuzzy Hash: b076ad593769f706d535175aa7115e37a110d57c25e6c28f7bf4ed710d338876
Instruction Fuzzy Hash: 9521C339B08A5281EB589B25E864ABD63B0FF48F98F458171DA6D876DCEE3CD505C300

Function 00007FFDFAC12947 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC12957
PyDict_GetItem.PYTHON313 ref: 00007FFDFAC12973
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC12989
PyObject_IsSubclass.PYTHON313 ref: 00007FFDFAC129A2
PyErr_SetString.PYTHON313 ref: 00007FFDFAC12A47

Strings

The type does not declare a PyCom constructor, xrefs: 00007FFDFAC12A5E
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFAC129B0
There is no interface object registered that supports this IID, xrefs: 00007FFDFAC12A36

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Object_$D@@@DeallocDict_Err_FromItemStringSubclassU_object@@
String ID: The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 3263611697-49823770
Opcode ID: 036263f03288f809a103d90402488b2def5c9c2016db8842f779003b3f5b278d
Instruction ID: 46b4318f16970207243f15751c23d759cadf8ae391bd2241eb68f1a15a438d4a
Opcode Fuzzy Hash: 036263f03288f809a103d90402488b2def5c9c2016db8842f779003b3f5b278d
Instruction Fuzzy Hash: C121DB2DB09A47A5FB689B1AE46497C63A0FF49B84B4844B1CE2E577DCDF2CF4158300

Function 00007FFDFABC5980 Relevance: 15.1, APIs: 10, Instructions: 82COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON313 ref: 00007FFDFABC59AC
PyObject_GetAttrString.PYTHON313 ref: 00007FFDFABC59C9
PyTuple_New.PYTHON313 ref: 00007FFDFABC59E2
PyObject_Call.PYTHON313 ref: 00007FFDFABC59F4
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC5A0B
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC5A1F
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC5A41
PyTuple_New.PYTHON313 ref: 00007FFDFABC5A49
PySeqIter_New.PYTHON313 ref: 00007FFDFABC5A5A
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC5A71

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Dealloc$Object_Tuple_$AttrCallErr_Iter_OccurredString
String ID:
API String ID: 1842946783-0
Opcode ID: 30840a5172524e7a32e1315caef83c5c78a376f1f2b4b0115a9ff0c46ff3b528
Instruction ID: 4210404b0634a619e169e014e6c30b5f003df85d2c176407e0baa39d009bfa50
Opcode Fuzzy Hash: 30840a5172524e7a32e1315caef83c5c78a376f1f2b4b0115a9ff0c46ff3b528
Instruction Fuzzy Hash: 8E317035B1D68282FB5C4B26A9A4A7C63E4EF08FA4F485574DA2E467D8EF3CE440C700

Function 00007FFDFAC058B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 86threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC058CC
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC058FB
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0592C
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC05951
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFAC0597E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFAC05996

Strings

O:ReadMultiple, xrefs: 00007FFDFAC058F4
The Python object is invalid, xrefs: 00007FFDFAC058BE

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_FreeObject_ParseRestoreSaveStringTuplefree
String ID: O:ReadMultiple$The Python object is invalid
API String ID: 2004998745-3093747771
Opcode ID: f71ad35e3ce4d7907b8597667d0c4d55bd6b92175340d3c0e9871b5319c1374e
Instruction ID: 1214d9f0bdb180150f32e5284582b6bebbe872d116b701aad58041ec5c6a2f6c
Opcode Fuzzy Hash: f71ad35e3ce4d7907b8597667d0c4d55bd6b92175340d3c0e9871b5319c1374e
Instruction Fuzzy Hash: B3314E79B0875686FB589F15A42097E63A4FF84B94F488075DEAE87798CE3CE441C700

Function 00007FFDFABFBAD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABFBAFF
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFABFBB1C
PyErr_SetString.PYTHON313 ref: 00007FFDFABFBB69
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABFBB99
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABFBBBC
?PyWinObject_FreeBstr@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFABFBBCA

Part of subcall function 00007FFDFABC3CD0: PyErr_GivenExceptionMatches.PYTHON313(?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3CFE
Part of subcall function 00007FFDFABC3CD0: PyErr_Format.PYTHON313(?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC3817), ref: 00007FFDFABC3D21

Strings

O|O:AddError, xrefs: 00007FFDFABFBAF8
The Python object is invalid, xrefs: 00007FFDFABFBB5B

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$Bstr@@Eval_Object_Thread$Arg_ExceptionFormatFreeGivenMatchesParseRestoreSaveStringTupleU_object@@
String ID: O|O:AddError$The Python object is invalid
API String ID: 3793072557-3687480771
Opcode ID: 5d3eacd9fdcd198a6d97b740e11e0ffa49ddd8cb51bb2ef2fbbe702c20ddabda
Instruction ID: 4499153ce8c7e0cf60cee714ee025830d6e52e7c8a312623418b1cb5ceb9769f
Opcode Fuzzy Hash: 5d3eacd9fdcd198a6d97b740e11e0ffa49ddd8cb51bb2ef2fbbe702c20ddabda
Instruction Fuzzy Hash: E2314F29B08A9291EB689B55E464ABD63A1FF45BC0F9840B1CA6D437EDCE2CE845C700

Function 00007FFDFAC0DB30 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 71threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC0DB5A
?PyWinObject_AsULARGE_INTEGER@@YAHPEAU_object@@PEAT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FFDFAC0DB6E
?PyWinObject_AsULARGE_INTEGER@@YAHPEAU_object@@PEAT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FFDFAC0DB82
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0DB9F
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0DBC9
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0DBF0

Strings

OOl:LockRegion, xrefs: 00007FFDFAC0DB53
The Python object is invalid, xrefs: 00007FFDFAC0DB91

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Object_R@@@ThreadU_object@@$Arg_Err_ParseRestoreSaveStringTuple
String ID: OOl:LockRegion$The Python object is invalid
API String ID: 1237504214-4112771913
Opcode ID: 583ac6f6a7b2d3b325abf9571a71653352bc30e05c09e8e4a8778b2201d32445
Instruction ID: 739f2d199810a4734fd860027f8e340682eacaea9d3d98b8e83ba12d6f56054a
Opcode Fuzzy Hash: 583ac6f6a7b2d3b325abf9571a71653352bc30e05c09e8e4a8778b2201d32445
Instruction Fuzzy Hash: C1314139B18A5282FB099B19E46097D63B1FF84BC0F4841B2DA6D93BACDF2CE545C700

Function 00007FFDFAC0DC40 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 71threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC0DC6A
?PyWinObject_AsULARGE_INTEGER@@YAHPEAU_object@@PEAT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FFDFAC0DC7E
?PyWinObject_AsULARGE_INTEGER@@YAHPEAU_object@@PEAT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FFDFAC0DC92
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0DCAF
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0DCD9
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0DD00

Strings

OOl:UnlockRegion, xrefs: 00007FFDFAC0DC63
The Python object is invalid, xrefs: 00007FFDFAC0DCA1

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Object_R@@@ThreadU_object@@$Arg_Err_ParseRestoreSaveStringTuple
String ID: OOl:UnlockRegion$The Python object is invalid
API String ID: 1237504214-1091026457
Opcode ID: b9c703d6c9087a84d810538eb5f4ad80f2c0210cecc395d038fe501e8c3d8248
Instruction ID: 4b98e30ad56172cce9ef12035ecf7c75446aae3124d5aef545b549fa02bc7598
Opcode Fuzzy Hash: b9c703d6c9087a84d810538eb5f4ad80f2c0210cecc395d038fe501e8c3d8248
Instruction Fuzzy Hash: 8C313C39B18B5282EB099B15E42097D63B1FF84BD0F494172DA6E97BACCF2CE445CB00

Function 00007FFDFAC0D880 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 69threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC0D8A4
?PyWinObject_AsULARGE_INTEGER@@YAHPEAU_object@@PEAT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FFDFAC0D8B8
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0D8E8
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0D912
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0D93F
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FFDFAC0D96F

Strings

OO:CopyTo, xrefs: 00007FFDFAC0D89D
The Python object is invalid, xrefs: 00007FFDFAC0D8DA

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Object_R@@@ThreadU_object@@$Arg_Err_FromParseRestoreSaveStringTuple
String ID: OO:CopyTo$The Python object is invalid
API String ID: 3769410717-3963427383
Opcode ID: 0ff8399650e44c255e73c1cff1ee35e442128f36fe39c8dd57b82dceeee54500
Instruction ID: 3803b524c6486902d0e5fa56e86b6c433eb394bd1c83e42acec755c282a354a6
Opcode Fuzzy Hash: 0ff8399650e44c255e73c1cff1ee35e442128f36fe39c8dd57b82dceeee54500
Instruction Fuzzy Hash: D7217129B08B5281EB498B15F51496EA7A1FF84BD0F4841B2EE6D57B9CDF2CE441C740

Function 00007FFDFABEEB50 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 66threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABEEB6C
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABEEBA0
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFABEEBBA
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABEEBCE
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABEEBF2
SysFreeString.OLEAUT32 ref: 00007FFDFABEEBFD

Strings

iO:SetVarDocString, xrefs: 00007FFDFABEEB99
The Python object is invalid, xrefs: 00007FFDFABEEB5E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_StringThread$Arg_Bstr@@Err_FreeObject_ParseRestoreSaveTupleU_object@@
String ID: The Python object is invalid$iO:SetVarDocString
API String ID: 3407569068-2282593860
Opcode ID: 1c1a0558f9a89a3df84aefd31254a9cf58e8482bd72ba2b62b46dd2847a70530
Instruction ID: 0400e23be46c8b3775e06605a02e0a92737911069568937ddff04b95b2585c31
Opcode Fuzzy Hash: 1c1a0558f9a89a3df84aefd31254a9cf58e8482bd72ba2b62b46dd2847a70530
Instruction Fuzzy Hash: D6216139B18A4292EB189B15E4A097DA3A0FF88BD4F8401B2DE6D477ACCF7CE541C700

Function 00007FFDFABEEA50 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 66threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABEEA6C
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABEEAA0
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFABEEABA
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABEEACE
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABEEAF2
SysFreeString.OLEAUT32 ref: 00007FFDFABEEAFD

Strings

iO:SetFuncDocString, xrefs: 00007FFDFABEEA99
The Python object is invalid, xrefs: 00007FFDFABEEA5E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_StringThread$Arg_Bstr@@Err_FreeObject_ParseRestoreSaveTupleU_object@@
String ID: The Python object is invalid$iO:SetFuncDocString
API String ID: 3407569068-4220370050
Opcode ID: 4bd18c0c0aef9865da23a19cd62e2a8132cbe02ff8fab13e00edfad5281c6bc6
Instruction ID: fc8159fd7d26c6f75051bb9de91d339e57eef2684a244cab543f63eb5faf3493
Opcode Fuzzy Hash: 4bd18c0c0aef9865da23a19cd62e2a8132cbe02ff8fab13e00edfad5281c6bc6
Instruction Fuzzy Hash: DC218029B08A4292EB18DB15E46097DA3A0FF84BD4F840171DE6D477ACCF6CE551C700

Function 00007FFDFAC0BF10 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC0BF41
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0BF65

Strings

|i:Stat, xrefs: 00007FFDFAC0BF7F
The Python object is invalid, xrefs: 00007FFDFAC0BF3A

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$|i:Stat
API String ID: 1450464846-438154399
Opcode ID: 03d27f6cd823bc68460e4f5b24138ff463692876b82749a1b6796840e68f2361
Instruction ID: 11d2133db17c83ff954e966290a55396e50c1e9a1a936e02d4bc0d1bdab76d8f
Opcode Fuzzy Hash: 03d27f6cd823bc68460e4f5b24138ff463692876b82749a1b6796840e68f2361
Instruction Fuzzy Hash: 9931EA29B1CA9295FB68DB25E824B7D63A1FF48B84F4444B1DA6E877D8DF2CE105C700

Function 00007FFDFABCCBA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 62threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABCCBC4
PyErr_SetString.PYTHON313 ref: 00007FFDFABCCBE1
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABCCC0B
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABCCC31
PyErr_SetString.PYTHON313 ref: 00007FFDFABCCC57
PyLong_FromLong.PYTHON313 ref: 00007FFDFABCCC7C

Strings

ll:GetNextDispID, xrefs: 00007FFDFABCCBBD
The Python object is invalid, xrefs: 00007FFDFABCCBD3

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_Eval_StringThread$Arg_FromLongLong_ParseRestoreSaveTuple
String ID: The Python object is invalid$ll:GetNextDispID
API String ID: 3585401115-2683501322
Opcode ID: dba40165bb274f674a800d89b07beb8353929207fc070817e28f3030d6dae698
Instruction ID: b818b90abfef58c378f143310a009ce2b584057027ee4d35891c7e4627c91dc7
Opcode Fuzzy Hash: dba40165bb274f674a800d89b07beb8353929207fc070817e28f3030d6dae698
Instruction Fuzzy Hash: 68215929B08A5182EB199B15E42486EA3B1FF85BD4B4944B2DE6D477ACCE3CE845C700

Function 00007FFDFABCC9C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 62threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABCC9E4
PyErr_SetString.PYTHON313 ref: 00007FFDFABCCA01
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABCCA2B
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABCCA51
PyErr_SetString.PYTHON313 ref: 00007FFDFABCCA77
PyLong_FromLong.PYTHON313 ref: 00007FFDFABCCA9C

Strings

ll:GetMemberProperties, xrefs: 00007FFDFABCC9DD
The Python object is invalid, xrefs: 00007FFDFABCC9F3

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_Eval_StringThread$Arg_FromLongLong_ParseRestoreSaveTuple
String ID: The Python object is invalid$ll:GetMemberProperties
API String ID: 3585401115-1689953799
Opcode ID: 6773aebb0552f90b87024fba1c80ac9a8c962fac13284a52210819a8353202a0
Instruction ID: 2ec3dd1e6b36aba83d7842ef72797c286e97694d12f9ec0db9de69d8aa7c1666
Opcode Fuzzy Hash: 6773aebb0552f90b87024fba1c80ac9a8c962fac13284a52210819a8353202a0
Instruction Fuzzy Hash: 54216D29B18A9182FB09DB15F42886EA3B1FF44BD4B4544B2EE6D577ACCE3CE445C700

Function 00007FFDFABCCAB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABCCACF
PyErr_SetString.PYTHON313 ref: 00007FFDFABCCAEC
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABCCB16
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABCCB37
PyErr_SetString.PYTHON313 ref: 00007FFDFABCCB5D
?PyWinObject_FromBstr@@YAPEAU_object@@QEA_WH@Z.PYWINTYPES313 ref: 00007FFDFABCCB88

Strings

l:GetMemberName, xrefs: 00007FFDFABCCAC5
The Python object is invalid, xrefs: 00007FFDFABCCADE

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_Eval_StringThread$Arg_Bstr@@FromObject_ParseRestoreSaveTupleU_object@@
String ID: The Python object is invalid$l:GetMemberName
API String ID: 1556122010-1980173406
Opcode ID: aa43aa8e3163910c36c1acd51888c3bc586840f125a876eceb18a3e02078f713
Instruction ID: f5e68a4db738adbd71f3b9be29fe376266db95e2fd341c3ac9847158c4ac2277
Opcode Fuzzy Hash: aa43aa8e3163910c36c1acd51888c3bc586840f125a876eceb18a3e02078f713
Instruction Fuzzy Hash: B9215E29B08A5182FB19DB56F46897D63A1FF88BD0B4550B2EE6D5779CCE3CE441C700

Function 00007FFDFABEBB50 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABEBB79
PyErr_SetString.PYTHON313 ref: 00007FFDFABEBB96
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABEBBCD
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABEBBEA
PyErr_SetString.PYTHON313 ref: 00007FFDFABEBC10
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABEBC30

Strings

:GetConnectionInterface, xrefs: 00007FFDFABEBB72
The Python object is invalid, xrefs: 00007FFDFABEBB88

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_Eval_StringThread$Arg_D@@@FromObject_ParseRestoreSaveTupleU_object@@
String ID: :GetConnectionInterface$The Python object is invalid
API String ID: 3773594425-258588504
Opcode ID: a016701330fac4bc03f41be50d013bc5647b0b35b425ce7046a012ba37739b6e
Instruction ID: 099195b9d551797dc11f5147c5f979d960d9abffe2c81714b45970c80d9f6c8b
Opcode Fuzzy Hash: a016701330fac4bc03f41be50d013bc5647b0b35b425ce7046a012ba37739b6e
Instruction Fuzzy Hash: 44213D69B1CA4292FB19DB25E8A493D63A1FF48BC0F4494B2D96E577DCCF2CE8058701

Function 00007FFDFABE78E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABE7902
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FFDFABE7910
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FFDFABE791E
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE796C
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE7985
PyGILState_Release.PYTHON313 ref: 00007FFDFABE798E

Strings

OOi, xrefs: 00007FFDFABE7930
UnlockRegion, xrefs: 00007FFDFABE793C

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: DeallocFromObject_R@@@State_U_object@@$EnsureRelease
String ID: OOi$UnlockRegion
API String ID: 3423895773-62055282
Opcode ID: 4215f9fd1ef614c999e31b95be39ce9004df87e44a54963358e441a45e3f8d0b
Instruction ID: 05da2cc6688e18fc19be6cd97682d598ff30e71c8ad3150b6f31f0444e3541f4
Opcode Fuzzy Hash: 4215f9fd1ef614c999e31b95be39ce9004df87e44a54963358e441a45e3f8d0b
Instruction Fuzzy Hash: EC21803AB08B4296E7188F25F4549ADB3B0FB44B94F484171DE9942B98DF3CD9858700

Function 00007FFDFABFD860 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABFD882
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FFDFABFD890
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FFDFABFD89E
_Py_Dealloc.PYTHON313 ref: 00007FFDFABFD8EC
_Py_Dealloc.PYTHON313 ref: 00007FFDFABFD905
PyGILState_Release.PYTHON313 ref: 00007FFDFABFD90E

Strings

OOi, xrefs: 00007FFDFABFD8B0
UnlockRegion, xrefs: 00007FFDFABFD8BC

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: DeallocFromObject_R@@@State_U_object@@$EnsureRelease
String ID: OOi$UnlockRegion
API String ID: 3423895773-62055282
Opcode ID: 6c5f0d7ec2974498c2233339cf58cf3b1f740b934650b0d17970f7caf35b55de
Instruction ID: b474dead6a8b4a0c74c470bb4574914949a78910873c4b8857669b8cc5f659b5
Opcode Fuzzy Hash: 6c5f0d7ec2974498c2233339cf58cf3b1f740b934650b0d17970f7caf35b55de
Instruction Fuzzy Hash: 9B21A436B08B9296E7188F65F818AAD73A0FB45B98F484071DE9E83B98DF3CD545C740

Function 00007FFDFABFBF20 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABFBF3C
PyErr_SetString.PYTHON313 ref: 00007FFDFABFBF61

Strings

iii:ReleaseConnection, xrefs: 00007FFDFABFBF86
The Python object is invalid, xrefs: 00007FFDFABFBF35

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$iii:ReleaseConnection
API String ID: 1450464846-93901103
Opcode ID: 2c1f4a2d74e4335d5a976ce2070c5015a382f9bd075e807923e8f1b9fcc0981f
Instruction ID: 3c9e7281342f730bf8278c777f60f8063688191f95fb7bdbf8d44d80298df90d
Opcode Fuzzy Hash: 2c1f4a2d74e4335d5a976ce2070c5015a382f9bd075e807923e8f1b9fcc0981f
Instruction Fuzzy Hash: E1115469B1864282FB08DB65E86487DA3E1FF84B94B480471DE6D877A8DF7CD486CB00

Function 00007FFDFABD6B60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 51windowthreadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABD6B82
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD6B99
PeekMessageW.USER32 ref: 00007FFDFABD6BC1
DispatchMessageW.USER32 ref: 00007FFDFABD6BDC
PeekMessageW.USER32 ref: 00007FFDFABD6C01
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD6C15
PyLong_FromLong.PYTHON313 ref: 00007FFDFABD6C1D

Strings

|ii:PumpWaitingMessages, xrefs: 00007FFDFABD6B71

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Message$Eval_PeekThread$Arg_DispatchFromLongLong_ParseRestoreSaveTuple
String ID: |ii:PumpWaitingMessages
API String ID: 2978160965-283788920
Opcode ID: e25b213729586b89b7e1090f27b4ad4a897fa623284e9843bbfdffd24b0fd718
Instruction ID: 559785b01ab7a24cbb2e19038d4eb667d6c69fbcf76c68238a071bd00ef93563
Opcode Fuzzy Hash: e25b213729586b89b7e1090f27b4ad4a897fa623284e9843bbfdffd24b0fd718
Instruction Fuzzy Hash: 1F218E75B2864293F7288F25E464A7E77A0FB88B40F844075DA9E83698DF3CD489CB00

Function 00007FFDFABFBE60 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABFBE7C
PyErr_SetString.PYTHON313 ref: 00007FFDFABFBEA1

Strings

i|i:AddConnection, xrefs: 00007FFDFABFBEC4
The Python object is invalid, xrefs: 00007FFDFABFBE75

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$i|i:AddConnection
API String ID: 1450464846-2306822277
Opcode ID: 0f492deffab50aec972e6e3766ae9050fbe53914a095a4795ea5d4e9db0f3359
Instruction ID: 0a5d973dc07a419407b3d064369bd8074409f93fa249fe8c396a6300dd70b174
Opcode Fuzzy Hash: 0f492deffab50aec972e6e3766ae9050fbe53914a095a4795ea5d4e9db0f3359
Instruction Fuzzy Hash: C1116669B2864182FB089B65E86497D63E1FF48B85F481471DA2D4779CDF3CD495C700

Function 00007FFDFAC129BC Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC129EF
PyDict_GetItem.PYTHON313 ref: 00007FFDFAC12A0B
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC12A21
PyErr_Clear.PYTHON313 ref: 00007FFDFAC12A30
PyErr_SetString.PYTHON313 ref: 00007FFDFAC12A47

Strings

The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FFDFAC129B0
There is no interface object registered that supports this IID, xrefs: 00007FFDFAC12A36

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$ClearD@@@DeallocDict_FromItemObject_StringU_object@@
String ID: The Python IID map is invalid - the value is not an interface type object$There is no interface object registered that supports this IID
API String ID: 1220624143-2203674046
Opcode ID: 799eb4144d1e9fda82e894eed1fed6be66e4941ddda7be9e6150ac0c8dbabbc2
Instruction ID: 31c2efd60b8fca153acadaf398e6270ce24dc8b33b965fd7a539748f4940c226
Opcode Fuzzy Hash: 799eb4144d1e9fda82e894eed1fed6be66e4941ddda7be9e6150ac0c8dbabbc2
Instruction Fuzzy Hash: 2321C82DB09A07A5FB699B1AE86497C23E0FB55B84B0844B1DE2E977DCDE2CF4158300

Function 00007FFDFABD6C30 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47windowthreadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD6C3A
GetMessageW.USER32 ref: 00007FFDFABD6C50
TranslateMessage.USER32 ref: 00007FFDFABD6C65
DispatchMessageW.USER32 ref: 00007FFDFABD6C70
GetMessageW.USER32 ref: 00007FFDFABD6C83
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD6C93
?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z.PYWINTYPES313 ref: 00007FFDFABD6CA7

Strings

GetMessage, xrefs: 00007FFDFABD6CA0

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Message$Eval_Thread$DispatchError@@RestoreSaveTranslateU_object@@Win_
String ID: GetMessage
API String ID: 3900028698-1164900787
Opcode ID: e6ecb68bd015fce085db3268bd58da63cfc02d1f7b26363086a63898205d8560
Instruction ID: 07d87b16e1c6a8cffa20934b42e297139a279c0c1ad67cdbc3ccdbd87c7da205
Opcode Fuzzy Hash: e6ecb68bd015fce085db3268bd58da63cfc02d1f7b26363086a63898205d8560
Instruction Fuzzy Hash: 1711603AF1865292F7189B28F4B483D73A1FF99B54F884170DA6E836E8DE3CD544C600

Function 00007FFDFABC7A80 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABC7AB0
PyObject_CallMethod.PYTHON313 ref: 00007FFDFABC7AC6
PyLong_AsLong.PYTHON313 ref: 00007FFDFABC7AE7
PyErr_Clear.PYTHON313 ref: 00007FFDFABC7AEF
_Py_Dealloc.PYTHON313 ref: 00007FFDFABC7B03
PyGILState_Release.PYTHON313 ref: 00007FFDFABC7B13

Strings

_GetTypeInfoCount_, xrefs: 00007FFDFABC7ABA

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$CallClearDeallocEnsureErr_LongLong_MethodObject_Release
String ID: _GetTypeInfoCount_
API String ID: 1740581890-274466297
Opcode ID: 9b56a112c6108d4246eaab6b5d6279952be9b18935cfd93ace92ec68f868ca36
Instruction ID: 4e35cf4393628a5363614b0dc3ae47f29e4870ba11b5966e6e5ef661938a07c8
Opcode Fuzzy Hash: 9b56a112c6108d4246eaab6b5d6279952be9b18935cfd93ace92ec68f868ca36
Instruction Fuzzy Hash: 07113D35F28A4282FB499F25E868A3D63E0EF48B94F495470EA2E466D9DF3CD495C700

Function 00007FFDFAC14888 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

VariantChangeType.OLEAUT32 ref: 00007FFDFAC1489B
wsprintfW.USER32 ref: 00007FFDFAC148B4
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC148BF
PyErr_SetObject.PYTHON313 ref: 00007FFDFAC148DE
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC148F9
PyFloat_FromDouble.PYTHON313 ref: 00007FFDFAC1490A
VariantClear.OLEAUT32 ref: 00007FFDFAC14B36

Strings

Error converting floating point variant (%08lx), xrefs: 00007FFDFAC148A8

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: FromVariant$ChangeClearDeallocDoubleErr_Float_ObjectObject_TypeU_object@@wsprintf
String ID: Error converting floating point variant (%08lx)
API String ID: 3578438641-723133735
Opcode ID: 7b9100170c47cf82d6be861ec80c7564b581fae52cf5e70215ff36a4249ed944
Instruction ID: 2680d9f205184cfff194a4d5e8d905a8e6db6f70ad58461a675f3e49d02e9e15
Opcode Fuzzy Hash: 7b9100170c47cf82d6be861ec80c7564b581fae52cf5e70215ff36a4249ed944
Instruction Fuzzy Hash: 0E11633AB0894691EB288F21E964A7D6371FF44B85F404071C96E87ADCEE2CE545C700

Function 00007FFDFABCDAD0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON313 ref: 00007FFDFABCDB30
PyErr_Format.PYTHON313 ref: 00007FFDFABCDB65
PyMem_Malloc.PYTHON313 ref: 00007FFDFABCDB8F
PyErr_NoMemory.PYTHON313 ref: 00007FFDFABCDB9D
PyErr_Occurred.PYTHON313 ref: 00007FFDFABCDBAA

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

Strings

Both or neither data and size must be given, xrefs: 00007FFDFABCDB1F
Expecting a string of %d bytes (got %d), xrefs: 00007FFDFABCDB54

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_$RestoreSave$DeallocFormat$BuildErrorFromInfoMallocMem_MemoryObjectObject_OccurredU_object@@Value
String ID: Both or neither data and size must be given$Expecting a string of %d bytes (got %d)
API String ID: 1015436900-2690443178
Opcode ID: 541cc2881bb902600b62edfebd62530f55463ef425d13450d6587f9ca0eef94c
Instruction ID: a2e813a8c5a42a3dbc9e2474c170e32458a4cb2e088b5cf10d128d0ee1a02735
Opcode Fuzzy Hash: 541cc2881bb902600b62edfebd62530f55463ef425d13450d6587f9ca0eef94c
Instruction Fuzzy Hash: F441A26AB08A4281FF099B66E4609BD63A0AF88BD4F8840B5DF1D477D9DE3CD895C300

Function 00007FFDFAC06960 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAC06997
?PyWinSequence_Tuple@@YAPEAU_object@@PEAU1@PEAK@Z.PYWINTYPES313 ref: 00007FFDFAC069A4
PyErr_SetString.PYTHON313 ref: 00007FFDFAC069CF
?PyWinObject_AsTaskAllocatedWCHAR@@YAHPEAU_object@@PEAPEA_WH@Z.PYWINTYPES313 ref: 00007FFDFAC069EF
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC06A1E

Strings

Sequence not of required length, xrefs: 00007FFDFAC069BE

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: U_object@@$AllocatedDeallocErr_Object_Sequence_StringTaskTuple@@memset
String ID: Sequence not of required length
API String ID: 3802877123-3681608443
Opcode ID: ec2b3835aeb4cb23f991edbb89c86f72f6c84cd72b6655aa6ac6f4df67984581
Instruction ID: 27a0afc72966765fd913433612cd858ab9f93208ce6042d2553713a09db67e36
Opcode Fuzzy Hash: ec2b3835aeb4cb23f991edbb89c86f72f6c84cd72b6655aa6ac6f4df67984581
Instruction Fuzzy Hash: 0521712AB0875291FB58EF16E860A7D62A0FF84B80F58C071DFAD92698DF7CE445D700

Function 00007FFDFABEEC50 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABEEC6C
PyErr_SetString.PYTHON313 ref: 00007FFDFABEEC91

Strings

il:SetFuncHelpContext, xrefs: 00007FFDFABEECAC
The Python object is invalid, xrefs: 00007FFDFABEEC65

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$il:SetFuncHelpContext
API String ID: 1450464846-1720986224
Opcode ID: 207b0620f78b534ae241454e41f02b3fbf050e6041ef5f8a5e9026a3c760f57f
Instruction ID: e17d7649265b0eb672092f047b219309ffef0275ef3367b64d3697803746c831
Opcode Fuzzy Hash: 207b0620f78b534ae241454e41f02b3fbf050e6041ef5f8a5e9026a3c760f57f
Instruction Fuzzy Hash: 53217625B1864292EB499B55F46097D63F0FF44BC4F4450B1DA6D477ECDE2CD892C700

Function 00007FFDFABF2C10 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABF2C2C
PyErr_SetString.PYTHON313 ref: 00007FFDFABF2C51

Strings

il:QueryContinueDrag, xrefs: 00007FFDFABF2C6C
The Python object is invalid, xrefs: 00007FFDFABF2C25

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$il:QueryContinueDrag
API String ID: 1450464846-3400651177
Opcode ID: f45e342ba6e0fc2fb3e077bf475521d9d9f718775eaaa188412fa1d7fae8d8c4
Instruction ID: 00a7a1ab175797fb64b8b302613ae57e0c2e660a4bf2412c295d35b95583c5fc
Opcode Fuzzy Hash: f45e342ba6e0fc2fb3e077bf475521d9d9f718775eaaa188412fa1d7fae8d8c4
Instruction Fuzzy Hash: 71214139B1864282FB499B59F96087D63A1FF48BC4B8510B1DE6D477ECDE2CE5828740

Function 00007FFDFABED9A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABED9BC
PyErr_SetString.PYTHON313 ref: 00007FFDFABED9E1

Strings

ii:SetVersion, xrefs: 00007FFDFABED9FC
The Python object is invalid, xrefs: 00007FFDFABED9B5

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$ii:SetVersion
API String ID: 1450464846-3629498280
Opcode ID: cf1c2f856a55a7065fadcaff1d9a5eb844ae7163d3de7880d3f3f7c67d7ebb74
Instruction ID: def8d893abcc8995cf734f1d001033fb0acfe53f8a85bf91b40777372dbae246
Opcode Fuzzy Hash: cf1c2f856a55a7065fadcaff1d9a5eb844ae7163d3de7880d3f3f7c67d7ebb74
Instruction Fuzzy Hash: F0217429B1C64282EB499B59F86487D63F1FF84BC4B841071DA6D477ECDE2CD992C700

Function 00007FFDFABEDEE0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABEDEFC
PyErr_SetString.PYTHON313 ref: 00007FFDFABEDF21

Strings

il:AddImplType, xrefs: 00007FFDFABEDF3C
The Python object is invalid, xrefs: 00007FFDFABEDEF5

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$il:AddImplType
API String ID: 1450464846-1746923440
Opcode ID: 47ff6f334fae4c991b868faaf62c38f4158b676c8e250733bb004cd0e98e2724
Instruction ID: bd71ba292d4a139c50d96e9a40b07c0f49396b135b4eafe45df26b0e9afaa962
Opcode Fuzzy Hash: 47ff6f334fae4c991b868faaf62c38f4158b676c8e250733bb004cd0e98e2724
Instruction Fuzzy Hash: 1A217429B1864282FB49DB59F96097D63B0FF48BC4B841071DA2D477ECDE2CE8828740

Function 00007FFDFABECED0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABECEFB
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABECF37
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABECF4B
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABECF5F
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABECF7C

Strings

O:RemoveProperty, xrefs: 00007FFDFABECF30
The Python object is invalid, xrefs: 00007FFDFABECEED

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_D@@@Err_Object_ParseRestoreSaveStringTupleU_object@@
String ID: O:RemoveProperty$The Python object is invalid
API String ID: 3738645356-4087211678
Opcode ID: 040a7eb2c656a0d0b57603d0d705fad14e6759eea0cb4f01b66a1dbc26044ed0
Instruction ID: 598e1f747128a8c6050eba36e6d58a10611f264be87c628f9fe067ba14603a01
Opcode Fuzzy Hash: 040a7eb2c656a0d0b57603d0d705fad14e6759eea0cb4f01b66a1dbc26044ed0
Instruction Fuzzy Hash: F9216D69B08B4281FB589B15E46497D63A1FF89BC4B840072E96E477ECCE3CE805C740

Function 00007FFDFABEFAD0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABEFAEC
PyErr_SetString.PYTHON313 ref: 00007FFDFABEFB11

Strings

i:SetLibFlags, xrefs: 00007FFDFABEFB27
The Python object is invalid, xrefs: 00007FFDFABEFAE5

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$i:SetLibFlags
API String ID: 1450464846-2322495625
Opcode ID: 2562f14780bbf32da11e68c6ef63daae7612092c20255e6b338b9a1dd8b12795
Instruction ID: 18b06785044922971b8149696f3cb872f95ddb77885c33bec8f661975095d560
Opcode Fuzzy Hash: 2562f14780bbf32da11e68c6ef63daae7612092c20255e6b338b9a1dd8b12795
Instruction Fuzzy Hash: 94213569B18A4282FB499B65F56447D63A1FF44BD0B8410B1DA2D477ECDE2CE8928700

Function 00007FFDFABEF8F0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABEF90C
PyErr_SetString.PYTHON313 ref: 00007FFDFABEF931

Strings

l:SetHelpContext, xrefs: 00007FFDFABEF947
The Python object is invalid, xrefs: 00007FFDFABEF905

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$l:SetHelpContext
API String ID: 1450464846-1782559897
Opcode ID: e58a9f49356529bd25aea2e62e18731c3c438f87ff39f524d39a6973dbaabf0d
Instruction ID: 6ee6c9d81ae97936638e2250c36ddf1952950b11234d86d2202ee56fc9fb77ea
Opcode Fuzzy Hash: e58a9f49356529bd25aea2e62e18731c3c438f87ff39f524d39a6973dbaabf0d
Instruction Fuzzy Hash: 28217729B0864292FB4DDB65F56487D23E1FF84BC0B8510B1D96D473ECDE2CE9828700

Function 00007FFDFABED8B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABED8CC
PyErr_SetString.PYTHON313 ref: 00007FFDFABED8F1

Strings

l:SetHelpContext, xrefs: 00007FFDFABED907
The Python object is invalid, xrefs: 00007FFDFABED8C5

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$l:SetHelpContext
API String ID: 1450464846-1782559897
Opcode ID: 28423b000cb26061461662dd8e210f37a83c18f9f6274b717cb28eccea32ce0a
Instruction ID: ddb7873a2462c91467710dfbb085c19153a4b55aec93c6d88f9444c60ebd8c54
Opcode Fuzzy Hash: 28423b000cb26061461662dd8e210f37a83c18f9f6274b717cb28eccea32ce0a
Instruction Fuzzy Hash: 00213269B1864282FB499B59F96487D63E1FF48BC0B8411B1DA2D477ECDE2CE8828740

Function 00007FFDFABF1A40 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABF1A5C
PyErr_SetString.PYTHON313 ref: 00007FFDFABF1A81

Strings

l:DUnadvise, xrefs: 00007FFDFABF1A97
The Python object is invalid, xrefs: 00007FFDFABF1A55

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$l:DUnadvise
API String ID: 1450464846-2503205131
Opcode ID: a813957bec1d72e4ec1a6eae360dc5f2416396f1f102a972e2c09c2b3303fa25
Instruction ID: 691d36419c261de0d785c1c791df6e68f4b599d27498dce949be356b81c2387e
Opcode Fuzzy Hash: a813957bec1d72e4ec1a6eae360dc5f2416396f1f102a972e2c09c2b3303fa25
Instruction Fuzzy Hash: AF216529B1868282FB4D9B59F56447D23E1FF44BC0B8514B2DA2D473DCDF2CE4818740

Function 00007FFDFABEF9E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABEF9FC
PyErr_SetString.PYTHON313 ref: 00007FFDFABEFA21

Strings

l:SetLcid, xrefs: 00007FFDFABEFA37
The Python object is invalid, xrefs: 00007FFDFABEF9F5

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$l:SetLcid
API String ID: 1450464846-1975059913
Opcode ID: e7cc0c30509e11d2abf7d419445596ac78027ea5511f5316dd060f6a19835668
Instruction ID: 1c621ebb3fa33163a32dde9e25f8a9d378600095024cbb0597a50b094e4a1906
Opcode Fuzzy Hash: e7cc0c30509e11d2abf7d419445596ac78027ea5511f5316dd060f6a19835668
Instruction Fuzzy Hash: E0213569B1864282FB499B65F96447D23B1FF48BC0B8414B1DA2D477ECDE2CE8968740

Function 00007FFDFABCC8D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABCC8EF
PyErr_SetString.PYTHON313 ref: 00007FFDFABCC90C
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABCC936
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABCC952
PyErr_SetString.PYTHON313 ref: 00007FFDFABCC978

Strings

ll:DeleteMemberByDispID, xrefs: 00007FFDFABCC8E5
The Python object is invalid, xrefs: 00007FFDFABCC8FE

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_Eval_StringThread$Arg_ParseRestoreSaveTuple
String ID: The Python object is invalid$ll:DeleteMemberByDispID
API String ID: 4015722556-3292498650
Opcode ID: a5df8b55589deb061659957de24a4f7d6eeae91b49485271400a67feb40f54c2
Instruction ID: d8a08b72841a46beae16e9601c07f5c58d7a5713397e7d1efce86f515020a44a
Opcode Fuzzy Hash: a5df8b55589deb061659957de24a4f7d6eeae91b49485271400a67feb40f54c2
Instruction Fuzzy Hash: 9B214D69B08A4282FB49DB16F46487D23A1FF99BC0B4554B2DE6E4779CCF2CE445C700

Function 00007FFDFABEFBC0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABEFBDC
PyErr_SetString.PYTHON313 ref: 00007FFDFABEFC01

Strings

:SaveAllChanges, xrefs: 00007FFDFABEFC0F
The Python object is invalid, xrefs: 00007FFDFABEFBD5

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: :SaveAllChanges$The Python object is invalid
API String ID: 1450464846-2045194468
Opcode ID: e3b4beaf66705dc055bca5aa73d3f743755cec424eca7cca90bfe4ca1cf32711
Instruction ID: fbc45e68c290d6ad313eac0d1d9571ca0993023985d79435e6fd1a54bfa76722
Opcode Fuzzy Hash: e3b4beaf66705dc055bca5aa73d3f743755cec424eca7cca90bfe4ca1cf32711
Instruction Fuzzy Hash: 7C212129B18A4282FB599B69F96447D63E1FF48BD0B4414B5DE2D473E8DE2CE4828700

Function 00007FFDFABF0860 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABF087C
PyErr_SetString.PYTHON313 ref: 00007FFDFABF08A1

Strings

:SaveAllChanges, xrefs: 00007FFDFABF08AF
The Python object is invalid, xrefs: 00007FFDFABF0875

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: :SaveAllChanges$The Python object is invalid
API String ID: 1450464846-2045194468
Opcode ID: 524a86bb67535f57cd7e37368eb3b70accfadd7efb0783afbcd54e972b16c612
Instruction ID: 1d1b0521846855f63f9a15d1d76dd61e1d4f0101450e1bd614babb49eca2cb04
Opcode Fuzzy Hash: 524a86bb67535f57cd7e37368eb3b70accfadd7efb0783afbcd54e972b16c612
Instruction Fuzzy Hash: 0B218329F18A4282FB4D9B59F96447D63E1FF48BD0B4450B1D92D477ECEE2CE4828300

Function 00007FFDFABEEF20 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABEEF3C
PyErr_SetString.PYTHON313 ref: 00007FFDFABEEF61

Strings

:LayOut, xrefs: 00007FFDFABEEF6F
The Python object is invalid, xrefs: 00007FFDFABEEF35

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: :LayOut$The Python object is invalid
API String ID: 1450464846-1669767414
Opcode ID: 1cabf6cc8e177c342894fe3dbd1f90d52ecd11badc6c63bd7b3fb77f68ceb350
Instruction ID: 663c8b448bdfa1731762c10cc9643a3a0b44bebbf2dea3ff378607ee41c00761
Opcode Fuzzy Hash: 1cabf6cc8e177c342894fe3dbd1f90d52ecd11badc6c63bd7b3fb77f68ceb350
Instruction Fuzzy Hash: 79214F29B18A4292FB499B59F9A497D23E1EF48BD0F4450B1DD2D473E8DE6CE8828340

Function 00007FFDFAC05F00 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC05F1C
PyErr_SetString.PYTHON313 ref: 00007FFDFAC05F41

Strings

:Revert, xrefs: 00007FFDFAC05F4F
The Python object is invalid, xrefs: 00007FFDFAC05F15

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_String
String ID: :Revert$The Python object is invalid
API String ID: 1450464846-2634774199
Opcode ID: f5d05b6c290b3732a8527d81052abd3ba78f4d97d504381f6430834c2dd880a3
Instruction ID: 99db6ff67ed017ecdfd2b37d2077f1199f1c917d72ee4745e0d5dc71ebc84b61
Opcode Fuzzy Hash: f5d05b6c290b3732a8527d81052abd3ba78f4d97d504381f6430834c2dd880a3
Instruction Fuzzy Hash: B2217429F1864282FB499B69F56447D23E0FF48BC0B4454B1D92D873E8DE2CE4828700

Function 00007FFDFABFFE60 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABFFE81
?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z.PYWINTYPES313 ref: 00007FFDFABFFEB5
PyErr_Occurred.PYTHON313 ref: 00007FFDFABFFED5
_Py_Dealloc.PYTHON313 ref: 00007FFDFABFFF13
PyGILState_Release.PYTHON313 ref: 00007FFDFABFFF1B

Strings

Unexpected exception in gateway method '%hs', xrefs: 00007FFDFABFFEED
GetWindow, xrefs: 00007FFDFABFFE93, 00007FFDFABFFEE4

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$DeallocEnsureErr_Object_OccurredReleaseU_object@@
String ID: GetWindow$Unexpected exception in gateway method '%hs'
API String ID: 1861843309-1335995098
Opcode ID: c95822b979ef2b8b8f56e3efc7faf64bd560c7fe4571ac7c9b6c5b8aacf3ac3f
Instruction ID: 7be74cdbe676f5dc92dbad819d3ba78d72e65dd253d12e0e91fe15e6ae6686b0
Opcode Fuzzy Hash: c95822b979ef2b8b8f56e3efc7faf64bd560c7fe4571ac7c9b6c5b8aacf3ac3f
Instruction Fuzzy Hash: 8221B636B08B4281FB189F75F864ABD63A0FF48B89F844071DA6E87699DE3CD549C340

Function 00007FFDFABFCF20 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABFCF3C
PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABFCF6B
?PyWinObject_AsULARGE_INTEGER@@YAHPEAU_object@@PEAT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FFDFABFCF7F
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABFCF93
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABFCFB0

Strings

O:SetSize, xrefs: 00007FFDFABFCF64
The Python object is invalid, xrefs: 00007FFDFABFCF2E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_Object_ParseR@@@RestoreSaveStringTupleU_object@@
String ID: O:SetSize$The Python object is invalid
API String ID: 2962986857-3826471295
Opcode ID: f24c684d653e7bd5ac2d89a7f3cb6726f8b0b8fb67570b73b1c91a7a256a9fc4
Instruction ID: aaade483b488121e9efba88f5991c0b09c637be342160e6c64b0ab76ae1cea65
Opcode Fuzzy Hash: f24c684d653e7bd5ac2d89a7f3cb6726f8b0b8fb67570b73b1c91a7a256a9fc4
Instruction Fuzzy Hash: C3213279B18A8281EB489B59F46487DA3A1FF45BC4B8810B1DA6D477ECDE2CE485C740

Function 00007FFDFAC03BA0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFAC03BC4
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC03BCF
PyErr_Occurred.PYTHON313 ref: 00007FFDFAC03BF4
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC03C51
PyGILState_Release.PYTHON313 ref: 00007FFDFAC03C59

Strings

Unexpected exception in gateway method '%hs', xrefs: 00007FFDFAC03C0C
Delete, xrefs: 00007FFDFAC03C03, 00007FFDFAC03C33

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$D@@@DeallocEnsureErr_FromObject_OccurredReleaseU_object@@
String ID: Delete$Unexpected exception in gateway method '%hs'
API String ID: 3892225778-2611616488
Opcode ID: 86d8d63662c665d91168bec63aac9c1226e2988ef76702e57dfe38975bab606a
Instruction ID: bbbd5206f1f4e07fc0a53c87cc8fab4714b6b2d4b501245611d68311ee280418
Opcode Fuzzy Hash: 86d8d63662c665d91168bec63aac9c1226e2988ef76702e57dfe38975bab606a
Instruction Fuzzy Hash: D8217139B18B5282EB189B25E824A7D63A1FF48B80F494175DA6E8779CDF3CE445C700

Function 00007FFDFAC17BC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

PyCapsule_GetPointer.PYTHON313 ref: 00007FFDFAC17BDF
PyErr_SetString.PYTHON313 ref: 00007FFDFAC17C06
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFAC17C28
PyErr_NoMemory.PYTHON313 ref: 00007FFDFAC17C36

Strings

GJS , xrefs: 00007FFDFAC17BED
argument does not contain a vtable, xrefs: 00007FFDFAC17BFC
win32com universal gateway, xrefs: 00007FFDFAC17BD5

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$Capsule_MemoryPointerStringmalloc
String ID: GJS $argument does not contain a vtable$win32com universal gateway
API String ID: 1948829242-3190988141
Opcode ID: 5d8f506d253d88b1354be9a8c3cabf78afe8173118980951495108892916f82b
Instruction ID: 9c3c1e95958d2f4f0e90a80fd77ce97361c931371f0fd95f8cf7179317c84842
Opcode Fuzzy Hash: 5d8f506d253d88b1354be9a8c3cabf78afe8173118980951495108892916f82b
Instruction Fuzzy Hash: FE21373A708B4196EB588F26E46452D73E0FB48B84B484471DA5E87799DF3CD495CB40

Function 00007FFDFAC0CEB0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFAC0CED3
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC0CEDF
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC0CEEB
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC0CF35
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC0CF4E
PyGILState_Release.PYTHON313 ref: 00007FFDFAC0CF57

Strings

RenameElement, xrefs: 00007FFDFAC0CF0D

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: DeallocFromObject_State_U_object@@$EnsureRelease
String ID: RenameElement
API String ID: 3506329694-3429006631
Opcode ID: 996c237859acac2b390b895f099ea73494587c58e18faef19165bf1d7d241df1
Instruction ID: 1ea266912cf1271e85284b667ef1d17493bbf4ba247f98367316f5483c0488a4
Opcode Fuzzy Hash: 996c237859acac2b390b895f099ea73494587c58e18faef19165bf1d7d241df1
Instruction Fuzzy Hash: 66211F3AB18B9296EB189F21E82466DB3A4FF44B94F484071DF9D87B98DF3CD1458700

Function 00007FFDFABFFA70 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABFFA86
PyErr_SetString.PYTHON313 ref: 00007FFDFABFFAA3
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABFFACD
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABFFAEA
PyLong_FromLong.PYTHON313 ref: 00007FFDFABFFB19

Strings

:Hash, xrefs: 00007FFDFABFFA7F
The Python object is invalid, xrefs: 00007FFDFABFFA95

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_FromLongLong_ParseRestoreSaveStringTuple
String ID: :Hash$The Python object is invalid
API String ID: 4099731610-1047631551
Opcode ID: 7fc268762b0f37317556f08693ca6fbf113839739d5558dc5ea0582fdaea5724
Instruction ID: d656e1aa9038c2bb1ccea84d4f75832e3a8acc5825149ed41d3fe91e6a4a3aba
Opcode Fuzzy Hash: 7fc268762b0f37317556f08693ca6fbf113839739d5558dc5ea0582fdaea5724
Instruction Fuzzy Hash: 45118429B18A8282EB099B65F96483D63B1FF44BD0B4850B2DE2D477ECDF2CE4858700

Function 00007FFDFABFF9B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABFF9C6
PyErr_SetString.PYTHON313 ref: 00007FFDFABFF9E3
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABFFA0D
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABFFA2D
PyLong_FromLong.PYTHON313 ref: 00007FFDFABFFA5C

Strings

:IsSystemMoniker, xrefs: 00007FFDFABFF9BF
The Python object is invalid, xrefs: 00007FFDFABFF9D5

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_FromLongLong_ParseRestoreSaveStringTuple
String ID: :IsSystemMoniker$The Python object is invalid
API String ID: 4099731610-130377936
Opcode ID: 4ec0e98927860b8fe2326392b6df68b3b808bd3d326975dc59c14b581ae27793
Instruction ID: 77dc8ab942e41bb9e9bcf144428ed577e8e1c9ef9dc6813276613edf411b1b70
Opcode Fuzzy Hash: 4ec0e98927860b8fe2326392b6df68b3b808bd3d326975dc59c14b581ae27793
Instruction Fuzzy Hash: 19118429B18A8282EB499B65F96457D63A1FF44BD0F4850B2DE6E477DCDF2CE4818700

Function 00007FFDFAC11EB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

PySequence_Check.PYTHON313 ref: 00007FFDFAC11ECB
PyErr_SetString.PYTHON313 ref: 00007FFDFAC11EE6
PySequence_Size.PYTHON313 ref: 00007FFDFAC11F10
PySequence_GetItem.PYTHON313 ref: 00007FFDFAC11F49
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC11F7D

Strings

ELEMDESCArray must be a sequence of ELEMDESCs, xrefs: 00007FFDFAC11EDC

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Sequence_$CheckDeallocErr_ItemSizeString
String ID: ELEMDESCArray must be a sequence of ELEMDESCs
API String ID: 448258277-796609628
Opcode ID: dc1cd77a3c7006cc522d2ce48a13b70fc3d1a93e41a3ec30296a1c4a113b6d4b
Instruction ID: a8fd1b4079998e983fa619d1ab21ab24306a008b494280342ce089f9dfdf03a6
Opcode Fuzzy Hash: dc1cd77a3c7006cc522d2ce48a13b70fc3d1a93e41a3ec30296a1c4a113b6d4b
Instruction Fuzzy Hash: E6216D2AB08A5296EB19DB26A82453E63E0FF45FD0F054475EE5C47B98EF3CE482C344

Function 00007FFDFABE58E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABE591C

Part of subcall function 00007FFDFABC5030: ?PyWinObject_FromBstr@@YAPEAU_object@@QEA_WH@Z.PYWINTYPES313(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC4EF2), ref: 00007FFDFABC5088
Part of subcall function 00007FFDFABC5030: ?PyWinObject_FromBstr@@YAPEAU_object@@QEA_WH@Z.PYWINTYPES313(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC4EF2), ref: 00007FFDFABC5097
Part of subcall function 00007FFDFABC5030: ?PyWinObject_FromBstr@@YAPEAU_object@@QEA_WH@Z.PYWINTYPES313(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC4EF2), ref: 00007FFDFABC50A6
Part of subcall function 00007FFDFABC5030: Py_BuildValue.PYTHON313(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC4EF2), ref: 00007FFDFABC50D2
Part of subcall function 00007FFDFABC5030: _Py_Dealloc.PYTHON313(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC4EF2), ref: 00007FFDFABC50F0
Part of subcall function 00007FFDFABC5030: _Py_Dealloc.PYTHON313(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC4EF2), ref: 00007FFDFABC5109
Part of subcall function 00007FFDFABC5030: _Py_Dealloc.PYTHON313(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFABC4EF2), ref: 00007FFDFABC5122

?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABE5958
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE599B
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE59B4
PyGILState_Release.PYTHON313 ref: 00007FFDFABE59BD

Part of subcall function 00007FFDFABC4250: PyErr_Occurred.PYTHON313 ref: 00007FFDFABC4259

Strings

AddError, xrefs: 00007FFDFABE596E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Dealloc$FromObject_U_object@@$Bstr@@$State_$BuildEnsureErr_OccurredReleaseValue
String ID: AddError
API String ID: 2964434163-917986504
Opcode ID: 8b5dc527ab8124f90fc987dab780a379741419373e6626fbcb4da0952e927563
Instruction ID: ece518baa64c18ebfb5d89f5efb15d0f08557e27a0c0176cee9c1a7c7777bd49
Opcode Fuzzy Hash: 8b5dc527ab8124f90fc987dab780a379741419373e6626fbcb4da0952e927563
Instruction Fuzzy Hash: 9131523AB1DA4282FB589B11E474ABDA3A4FF45BA4F444171DEAD47798EF3CE8418700

Function 00007FFDFABE6ED0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABE6F0C

Part of subcall function 00007FFDFAC14630: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC1468A
Part of subcall function 00007FFDFAC14630: PyErr_SetObject.PYTHON313 ref: 00007FFDFAC146A5
Part of subcall function 00007FFDFAC14630: _Py_Dealloc.PYTHON313 ref: 00007FFDFAC146B9

?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABE6F48
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE6F8B
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE6FA4
PyGILState_Release.PYTHON313 ref: 00007FFDFABE6FAD

Part of subcall function 00007FFDFABC4250: PyErr_Occurred.PYTHON313 ref: 00007FFDFABC4259

Strings

Write, xrefs: 00007FFDFABE6F5E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Dealloc$Err_FromObject_State_U_object@@$EnsureObjectOccurredRelease
String ID: Write
API String ID: 2919161206-3165279579
Opcode ID: 264a9844286a64c2dbd1b03adfa15f4ea4b779d7635e9e123e7830a94e63efae
Instruction ID: 456c4b5c2def8bee625386b1b3504d6814b23c2779e95df6c5043d7f313410ec
Opcode Fuzzy Hash: 264a9844286a64c2dbd1b03adfa15f4ea4b779d7635e9e123e7830a94e63efae
Instruction Fuzzy Hash: B5314F26B19A4282EB189B21E474A7D73A0FF45B94F484471EE6E4779CEF3CE8058740

Function 00007FFDFAC10B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC10BE3
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFAC10BFB
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC10C16
UnRegisterTypeLib.OLEAUT32 ref: 00007FFDFAC10C3C
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC10C47

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

Strings

Oii|ii, xrefs: 00007FFDFAC10BD9

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocObject_U_object@@$Arg_BuildD@@@Err_ErrorFromInfoObjectParseRegisterTupleTypeValue
String ID: Oii|ii
API String ID: 562348256-1081748617
Opcode ID: cdbcce718672a0ab732ea31a64a8aecc2985992c5ead62a3c583af3ff4cb2ded
Instruction ID: c39297e673723b142e6061b7d6cd189664915276d3a35ae7b9be2ed4a385e779
Opcode Fuzzy Hash: cdbcce718672a0ab732ea31a64a8aecc2985992c5ead62a3c583af3ff4cb2ded
Instruction Fuzzy Hash: 7031413AB08A4295EB14CF15E4645BE73B1FB88B80F550176DAAD83798DF3DD406CB00

Function 00007FFDFABE9F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 65threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABE9F4B
PyErr_SetString.PYTHON313 ref: 00007FFDFABE9F68
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABE9FAA
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABE9FCB

Strings

O:UnRegisterCategories, xrefs: 00007FFDFABE9F41
The Python object is invalid, xrefs: 00007FFDFABE9F5A

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: O:UnRegisterCategories$The Python object is invalid
API String ID: 3004187977-806227366
Opcode ID: 0aa1e33396c3abe562577b2a52788534e192636c5bf782ca5c7290cb517dc445
Instruction ID: de46cd03da4a17907b65663071f4d4f5bf75e62d4d4e23b413753a9c2f372fe9
Opcode Fuzzy Hash: 0aa1e33396c3abe562577b2a52788534e192636c5bf782ca5c7290cb517dc445
Instruction Fuzzy Hash: 0B215129B1CA5282EB18AF55E8605BDA3A0FF85B90F444072DE6D477EDCE2CE846C740

Function 00007FFDFAC0EB00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC0EB3E
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0EB56
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0EB75
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0EBAD
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0EBCB

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

Strings

The Python object is invalid, xrefs: 00007FFDFAC0EB1E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocErr_$BuildErrorFromInfoObjectObject_StringU_object@@Value
String ID: The Python object is invalid
API String ID: 3213920475-2445808733
Opcode ID: d0552a86027765dd99ebaaa5794eaa78f988985c2e0317647f4bda92920a4f84
Instruction ID: 6cffbc01c98e5ec7c7adc6e705fff41bc0ccf4efb73ffec6b082ff70e9fe796a
Opcode Fuzzy Hash: d0552a86027765dd99ebaaa5794eaa78f988985c2e0317647f4bda92920a4f84
Instruction Fuzzy Hash: B7217429B19A6182EB49DB16F45457E63B0FF88FD0B485072DE6E5779CCE3CD4428300

Function 00007FFDFAC06880 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFAC068A3

Part of subcall function 00007FFDFAC041A0: PyTuple_New.PYTHON313 ref: 00007FFDFAC041C2
Part of subcall function 00007FFDFAC041A0: PyLong_FromUnsignedLong.PYTHON313 ref: 00007FFDFAC041EA

PyErr_Occurred.PYTHON313 ref: 00007FFDFAC068D4
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC06930
PyGILState_Release.PYTHON313 ref: 00007FFDFAC06938

Strings

Unexpected exception in gateway method '%hs', xrefs: 00007FFDFAC068EC
DeleteMultiple, xrefs: 00007FFDFAC068E3, 00007FFDFAC06912

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$DeallocEnsureErr_FromLongLong_OccurredReleaseTuple_Unsigned
String ID: DeleteMultiple$Unexpected exception in gateway method '%hs'
API String ID: 667690297-3044724248
Opcode ID: dd87a41a8988dc3a1e173c03328119fded4540e4534685f9a4a472afc8debd36
Instruction ID: 972f5b980a28cb28e6647de6ebee69729f86d3b970567eb32ac0356ac2c73176
Opcode Fuzzy Hash: dd87a41a8988dc3a1e173c03328119fded4540e4534685f9a4a472afc8debd36
Instruction Fuzzy Hash: F5218639B1865292FB189F25E824ABD63B1FF48B84F484171DA6D877DDEE3CE4058300

Function 00007FFDFAC10EA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC10ECA
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FFDFAC10EE8
PyErr_SetString.PYTHON313 ref: 00007FFDFAC10F40
?PyWinObject_FreeBstr@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFAC10F5D

Strings

O|i:Bind, xrefs: 00007FFDFAC10EBC
The Python object is invalid, xrefs: 00007FFDFAC10F32

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Bstr@@Object_$Arg_Err_FreeParseStringTupleU_object@@
String ID: O|i:Bind$The Python object is invalid
API String ID: 3061223275-2584696442
Opcode ID: 0d960c27681c90812c89b8f24a092050a8bec021980732a51c3a71dcb4ad7379
Instruction ID: dc4e4477ac7cc8e6334f0596c30c50ce70eed2846ebba65762264e1e68e24c19
Opcode Fuzzy Hash: 0d960c27681c90812c89b8f24a092050a8bec021980732a51c3a71dcb4ad7379
Instruction Fuzzy Hash: D2217F29B1874292EB18CB56E46096EA3A0FF88BD0B490476EE6D47BDCDF7CD445C700

Function 00007FFDFABE6B00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABE6B4D
?PyWinObject_AsULARGE_INTEGER@@YAHPEAU_object@@PEAT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FFDFABE6B7F
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE6B97
PyErr_Clear.PYTHON313 ref: 00007FFDFABE6B9D
PyGILState_Release.PYTHON313 ref: 00007FFDFABE6BB1

Strings

GetSizeMax, xrefs: 00007FFDFABE6B5E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$ClearDeallocEnsureErr_Object_R@@@ReleaseU_object@@
String ID: GetSizeMax
API String ID: 1322101601-2032451762
Opcode ID: c2f3a04b8098f13dc8d09efc9a1f1450f9ebef33c473d39311d4dd7ebd679e11
Instruction ID: 0633197d4c3d28c75facaec579dcaf729a02f49e255112e97a46286fbf6ec076
Opcode Fuzzy Hash: c2f3a04b8098f13dc8d09efc9a1f1450f9ebef33c473d39311d4dd7ebd679e11
Instruction Fuzzy Hash: B021B33AB08B4682EB149B25E86467D63E1FF88BD4F444071DE5D8779CDE3CD8058700

Function 00007FFDFAC0D980 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 57threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC0D9A3
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0D9C0
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0D9EA
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0DA06

Strings

|l:Commit, xrefs: 00007FFDFAC0D99C
The Python object is invalid, xrefs: 00007FFDFAC0D9B2

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: The Python object is invalid$|l:Commit
API String ID: 3004187977-2642149698
Opcode ID: 39762e166c048825f1dc82f24496fd5b80e8c834e2555f4f23b50b578e639065
Instruction ID: ad7363ec4f7411e1173f8202b438169291360e916dd504494e7e6ab78aae5e8b
Opcode Fuzzy Hash: 39762e166c048825f1dc82f24496fd5b80e8c834e2555f4f23b50b578e639065
Instruction Fuzzy Hash: 34217C39B18A5282EB099B16F56497D63B1FF48BD0F4850B2DA6E437ECDF2CE4818740

Function 00007FFDFABF69E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABF69FB
PyErr_SetString.PYTHON313 ref: 00007FFDFABF6A18
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF6A42
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF6A5E

Strings

l:Skip, xrefs: 00007FFDFABF69F1
The Python object is invalid, xrefs: 00007FFDFABF6A0A

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: The Python object is invalid$l:Skip
API String ID: 3004187977-1306879369
Opcode ID: 0c5e10abf1e52133ccacacc21f7957437f35a3c10a868ab7f8285d1eee5ffa9a
Instruction ID: 7c46e74f2be3a58a0394e3fada7e6eb12aefcd52dbce1160b07cfed37caf64d9
Opcode Fuzzy Hash: 0c5e10abf1e52133ccacacc21f7957437f35a3c10a868ab7f8285d1eee5ffa9a
Instruction Fuzzy Hash: 53215E39B18A8282EB099B59F56487D63A1FF48BD0B8850B2DE6D4379CDE3CE8518700

Function 00007FFDFAC0DA60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC0DA76
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0DA93
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0DABD
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0DAD5

Strings

:Revert, xrefs: 00007FFDFAC0DA6F
The Python object is invalid, xrefs: 00007FFDFAC0DA85

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: :Revert$The Python object is invalid
API String ID: 3004187977-2634774199
Opcode ID: c8b6b02d35ee5d8b0445a639188fa3150b8f47c4fd2a52f6de6e58c157758a0d
Instruction ID: 7b54335891a69044752263e741bd729fa1f67193305b4f0ef70ecedee55a0248
Opcode Fuzzy Hash: c8b6b02d35ee5d8b0445a639188fa3150b8f47c4fd2a52f6de6e58c157758a0d
Instruction Fuzzy Hash: 19118E29B1CA5282FB099B59F96497D63B1EF48BD0B4850B1DD2E937ECCE2CE4818740

Function 00007FFDFABFAB20 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABFAB3B
PyErr_SetString.PYTHON313 ref: 00007FFDFABFAB58
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABFAB7D
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABFAB99

Strings

k:Skip, xrefs: 00007FFDFABFAB31
The Python object is invalid, xrefs: 00007FFDFABFAB4A

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: The Python object is invalid$k:Skip
API String ID: 3004187977-1356879153
Opcode ID: eb39dc8b6ecc3ff0706ae8988a9db6ecb0d5beceb7090706d5e28579cbf7df6b
Instruction ID: cc3d89cacbeedf88b495efe22f7126289e30ba2e54dfd0b31424fb208fea5bef
Opcode Fuzzy Hash: eb39dc8b6ecc3ff0706ae8988a9db6ecb0d5beceb7090706d5e28579cbf7df6b
Instruction Fuzzy Hash: B3116029B1864282EB0D9B55F56487D23A2FF88BD0B8850B5CA2D437DCDE3CE4458700

Function 00007FFDFABF4F20 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABF4F3B
PyErr_SetString.PYTHON313 ref: 00007FFDFABF4F58
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF4F7D
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF4F99

Strings

l:Skip, xrefs: 00007FFDFABF4F31
The Python object is invalid, xrefs: 00007FFDFABF4F4A

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: The Python object is invalid$l:Skip
API String ID: 3004187977-1306879369
Opcode ID: a0fe4324aeacb3d0180abc750c819c71f18971bff622495e98722b2e356bbec0
Instruction ID: 4ea3b2a13392898136f96e290cb164be3fc530c371e6fa17bf2088cc8a87dbf4
Opcode Fuzzy Hash: a0fe4324aeacb3d0180abc750c819c71f18971bff622495e98722b2e356bbec0
Instruction Fuzzy Hash: 84112C69B0864292EB0DDB56F56487D63A1FF89BD0B8950B2DA2D437DCDE3CE4458600

Function 00007FFDFABFDEB0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABFDECB
PyErr_SetString.PYTHON313 ref: 00007FFDFABFDEE8
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABFDF0D
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABFDF29

Strings

l:Skip, xrefs: 00007FFDFABFDEC1
The Python object is invalid, xrefs: 00007FFDFABFDEDA

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: The Python object is invalid$l:Skip
API String ID: 3004187977-1306879369
Opcode ID: 66129de6f6d0f6075f6df05228a047bda696570b23f4c61d4cb528d562b9f861
Instruction ID: 3738de2225c5e7586e257d4e62f9239162156ca7f395768e81bc0afad7c170cb
Opcode Fuzzy Hash: 66129de6f6d0f6075f6df05228a047bda696570b23f4c61d4cb528d562b9f861
Instruction Fuzzy Hash: F2115E39B0864282EB0DDB59F56497D63A1FF89BD0B8940B6C92D437DCDE3CE4418240

Function 00007FFDFABFABE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABFABF6
PyErr_SetString.PYTHON313 ref: 00007FFDFABFAC13
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABFAC38
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABFAC4F

Strings

:Reset, xrefs: 00007FFDFABFABEF
The Python object is invalid, xrefs: 00007FFDFABFAC05

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: :Reset$The Python object is invalid
API String ID: 3004187977-3082310266
Opcode ID: 83612420d81f6b9468827b63cfaf3c87c6a7196c45f7b094c872b5dfa0ad7630
Instruction ID: 6e470101768ed981b1575aab211c2d2559df021e9c9c2bf9dd4e2f3bdee09004
Opcode Fuzzy Hash: 83612420d81f6b9468827b63cfaf3c87c6a7196c45f7b094c872b5dfa0ad7630
Instruction Fuzzy Hash: 7D113369B18A4282FB0D9B5AE97497D23E1FF48BD0B895075C92D477DCDE3CE4918300

Function 00007FFDFABF8890 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABF88A6
PyErr_SetString.PYTHON313 ref: 00007FFDFABF88C3
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF88E8
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF88FF

Strings

:Reset, xrefs: 00007FFDFABF889F
The Python object is invalid, xrefs: 00007FFDFABF88B5

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: :Reset$The Python object is invalid
API String ID: 3004187977-3082310266
Opcode ID: 68f18b20b2b54fc4fb8e78159d94e5efd9ca99723c8a9c9add4e4e7cee4777a4
Instruction ID: 647bb05b5b73edb1b616c0be7115e0452f404c16a83d570ad7fe9ecec58fadb3
Opcode Fuzzy Hash: 68f18b20b2b54fc4fb8e78159d94e5efd9ca99723c8a9c9add4e4e7cee4777a4
Instruction Fuzzy Hash: D4113369F08A4281FB0D9B9AE96497D23E1FF48BD0B4950B5C92D477ECDE3CE4919300

Function 00007FFDFAC01F00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFAC01F16
PyErr_SetString.PYTHON313 ref: 00007FFDFAC01F33
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC01F5D
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC01F75

Strings

:IsDirty, xrefs: 00007FFDFAC01F0F
The Python object is invalid, xrefs: 00007FFDFAC01F25

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: :IsDirty$The Python object is invalid
API String ID: 3004187977-2698278726
Opcode ID: c8dcd4893b064f1eeebea729bae00eafd4a3d2d17882c28638f29c3709215d85
Instruction ID: 382b49eceacdc1ef68f341adace7ae6f1c0f42d7bb9619c567d07c249a646473
Opcode Fuzzy Hash: c8dcd4893b064f1eeebea729bae00eafd4a3d2d17882c28638f29c3709215d85
Instruction Fuzzy Hash: 8D115429F1CA5182EB099B25A96447DA3A1EF44FD0B085072DD2E877DCDF2CE4918300

Function 00007FFDFABC4BF0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

PyErr_Fetch.PYTHON313 ref: 00007FFDFABC4C21
PyErr_NormalizeException.PYTHON313 ref: 00007FFDFABC4C40
PyErr_GivenExceptionMatches.PYTHON313 ref: 00007FFDFABC4C55
PyErr_Restore.PYTHON313 ref: 00007FFDFABC4C7A
PyErr_Restore.PYTHON313 ref: 00007FFDFABC4C90

Strings

error, xrefs: 00007FFDFABC4CA0

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$ExceptionRestore$FetchGivenMatchesNormalize
String ID: error
API String ID: 3047404446-1574812785
Opcode ID: 78656cf6149c794b2f350da287e35863a10b2bf4f8e639e9a702d90701bcd437
Instruction ID: ee72ef8d7d306378ccc357f56ab0b8e5ee390fff6a24d6dd10bb0809bbe15182
Opcode Fuzzy Hash: 78656cf6149c794b2f350da287e35863a10b2bf4f8e639e9a702d90701bcd437
Instruction Fuzzy Hash: B6216DBA718B4291EB14CF11E4588AE73A4FB88BD4F444172DAAD43768DF3CD654CB50

Function 00007FFDFABE4B00 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

_Py_NewReference.PYTHON313 ref: 00007FFDFABE4B2D
PyTuple_New.PYTHON313 ref: 00007FFDFABE4B3F
PyLong_FromLong.PYTHON313 ref: 00007FFDFABE4B58
PyTuple_SetItem.PYTHON313 ref: 00007FFDFABE4B66
PyTuple_New.PYTHON313 ref: 00007FFDFABE4B86
PyTuple_SetItem.PYTHON313 ref: 00007FFDFABE4BA4

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Tuple_$Item$FromLongLong_Reference
String ID:
API String ID: 4085848814-0
Opcode ID: 83c834f8f0d030ea6a3659a01812351e35f06034e60eb05c416c313f162fac9a
Instruction ID: caf3b28424882d52e18535d7e71dcec01869d5e2ed1da75cad0fce8c2e0bc31b
Opcode Fuzzy Hash: 83c834f8f0d030ea6a3659a01812351e35f06034e60eb05c416c313f162fac9a
Instruction Fuzzy Hash: B3317A7AB047118AE354CF26E89496D77E8FB4CB94B054575EE5D83B48DF38D482C740

Function 00007FFDFAC15BC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

SafeArrayGetDim.OLEAUT32 ref: 00007FFDFAC15BE1

Part of subcall function 00007FFDFAC15970: SafeArrayGetLBound.OLEAUT32 ref: 00007FFDFAC15993

?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313(?,?,?,?,?,00007FFDFAC1470A), ref: 00007FFDFAC15C49
PyErr_SetObject.PYTHON313(?,?,?,?,?,00007FFDFAC1470A), ref: 00007FFDFAC15C64
_Py_Dealloc.PYTHON313(?,?,?,?,?,00007FFDFAC1470A), ref: 00007FFDFAC15C78

Strings

Internal error - unexpected argument - only simple VARIANTTYPE expected, xrefs: 00007FFDFAC15C42

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: ArraySafe$BoundDeallocErr_FromObjectObject_U_object@@
String ID: Internal error - unexpected argument - only simple VARIANTTYPE expected
API String ID: 1195713461-2832032402
Opcode ID: 6e16048078d03c25611247b060805e42c51dce872a3323787c3289adf07e5480
Instruction ID: b3e728e8d50135f3ef4d7c4af599034d8b3023f2068167539e3f74164ebf85e0
Opcode Fuzzy Hash: 6e16048078d03c25611247b060805e42c51dce872a3323787c3289adf07e5480
Instruction Fuzzy Hash: 64115729B09A0595EB549B26F82067D63A4FF8DBE0F080174DE6D877E9DF3CD4418700

Function 00007FFDFAC14BCC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

PyObject_Size.PYTHON313 ref: 00007FFDFAC14C11
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC14C22
PyErr_SetObject.PYTHON313 ref: 00007FFDFAC14C3D
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC14C51
??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z.PYWINTYPES313 ref: 00007FFDFAC14C97
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC14CB1
PyErr_SetObject.PYTHON313 ref: 00007FFDFAC14CCC
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC14CE0
??1PyWinBufferView@@QEAA@XZ.PYWINTYPES313 ref: 00007FFDFAC14CED
SafeArrayAccessData.OLEAUT32 ref: 00007FFDFAC14D02
memcpy.VCRUNTIME140 ref: 00007FFDFAC14D2A
SafeArrayUnaccessData.OLEAUT32 ref: 00007FFDFAC14D32
PySequence_GetItem.PYTHON313 ref: 00007FFDFAC14D6A
SafeArrayPutElement.OLEAUT32 ref: 00007FFDFAC14E0E
VariantClear.OLEAUT32 ref: 00007FFDFAC14E1B
PyErr_SetString.PYTHON313 ref: 00007FFDFAC14E33
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC14E4D
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC14E88
PyErr_SetObject.PYTHON313 ref: 00007FFDFAC14EA3
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC14EB7

Strings

All dimensions must be a sequence of the same size, xrefs: 00007FFDFAC14C1B

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: DeallocErr_Object_$ArrayFromObjectSafeU_object@@$BufferDataView@@$AccessClearElementItemSequence_SizeStringU_object@@_UnaccessVariantmemcpy
String ID: All dimensions must be a sequence of the same size
API String ID: 2035938186-2458871060
Opcode ID: 188d27091ff1154461be9ac25fcbaec1412ed2373bbb28757b84dee600d62ba4
Instruction ID: 8e35099e8a3d26d07d0971ef104048bd27b4948c769b233a7e08e6cbde024a37
Opcode Fuzzy Hash: 188d27091ff1154461be9ac25fcbaec1412ed2373bbb28757b84dee600d62ba4
Instruction Fuzzy Hash: CD118F76B05A42E5E7198F26E824BAD77A0FB48B98F044471DE2D86798DE3CE482C700

Function 00007FFDFAC0FEB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC0FEEE
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0FF06
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0FF25
PyLong_FromLong.PYTHON313 ref: 00007FFDFAC0FF54

Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4CFC
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D3F
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D49
Part of subcall function 00007FFDFABC4CC0: GetErrorInfo.OLEAUT32 ref: 00007FFDFABC4D59
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D64
Part of subcall function 00007FFDFABC4CC0: PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC4D85
Part of subcall function 00007FFDFABC4CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC4D9C
Part of subcall function 00007FFDFABC4CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFABC4DBC
Part of subcall function 00007FFDFABC4CC0: Py_BuildValue.PYTHON313 ref: 00007FFDFABC4DDD
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4DF4
Part of subcall function 00007FFDFABC4CC0: PyErr_SetObject.PYTHON313 ref: 00007FFDFABC4E07
Part of subcall function 00007FFDFABC4CC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFABC4E20

Strings

The Python object is invalid, xrefs: 00007FFDFAC0FECE

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocErr_From$BuildErrorInfoLongLong_ObjectObject_StringU_object@@Value
String ID: The Python object is invalid
API String ID: 4146544723-2445808733
Opcode ID: 9f4997666fbcdce15a9e5b79a0c0e1365b64e8e7288a22ea9514dc5812a2b943
Instruction ID: 406c2c72eb5edd3108412378a416e9621c434580296f631b6fdafd0831069369
Opcode Fuzzy Hash: 9f4997666fbcdce15a9e5b79a0c0e1365b64e8e7288a22ea9514dc5812a2b943
Instruction Fuzzy Hash: D4116369B18A9282EB09CB15F56446D63B1FF88BD4B4950B2DE2E5779CCE3CE881C740

Function 00007FFDFABE4EE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABE4EF5
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FFDFABE4F34
_Py_Dealloc.PYTHON313 ref: 00007FFDFABE4F61
PyGILState_Release.PYTHON313 ref: 00007FFDFABE4F69

Strings

GetConnectionInterface, xrefs: 00007FFDFABE4F19

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$D@@@DeallocEnsureObject_ReleaseU_object@@
String ID: GetConnectionInterface
API String ID: 1645649514-2932743419
Opcode ID: 3caffe5dda24372f0857224b57dbe1ca049435263498db17f41f8238655d8b32
Instruction ID: 065519785892502074c93ccb1c8f951f3e70dfaf51a91b8c300ddb01e42dff8e
Opcode Fuzzy Hash: 3caffe5dda24372f0857224b57dbe1ca049435263498db17f41f8238655d8b32
Instruction Fuzzy Hash: B2115135F18A4391FB588B25E8A4A7D63E0FF88F84F4440B1DA5E8769CDE2DD8458381

Function 00007FFDFABD4AE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABD4AFB
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD4B16
RevokeActiveObject.OLEAUT32 ref: 00007FFDFABD4B25
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD4B30

Strings

l:RevokeActiveObject, xrefs: 00007FFDFABD4AEF

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$ActiveArg_ObjectParseRestoreRevokeSaveTuple
String ID: l:RevokeActiveObject
API String ID: 2010330885-656249077
Opcode ID: 34b4421c3d6b4205db5e74b35b6e2d79deea5f250a84893d64cea8c58abbd185
Instruction ID: eda9b3ebf87cfb1ed9f638299346d12d5aae2ad680fe33b2f00daa6cf3916fcc
Opcode Fuzzy Hash: 34b4421c3d6b4205db5e74b35b6e2d79deea5f250a84893d64cea8c58abbd185
Instruction Fuzzy Hash: DA011E79B18A4292E71C9B16E864A7E63F1FBC9784F880175DA5D83798DF3CD505C700

Function 00007FFDFABF2EA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABF2EB4
PyLong_AsLong.PYTHON313 ref: 00007FFDFABF2F00
_Py_Dealloc.PYTHON313 ref: 00007FFDFABF2F1B
PyGILState_Release.PYTHON313 ref: 00007FFDFABF2F23

Strings

GiveFeedback, xrefs: 00007FFDFABF2ED4

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$DeallocEnsureLongLong_Release
String ID: GiveFeedback
API String ID: 1519730240-3077175550
Opcode ID: 3275b49b59b62248def1a8c46e5cc2b6caaf26893a42bd62287c9d9b9de76238
Instruction ID: e0f8b566bd7c9f77e3f6b5add6642b722065c68c9c6cd5d98ae0dc95852c3273
Opcode Fuzzy Hash: 3275b49b59b62248def1a8c46e5cc2b6caaf26893a42bd62287c9d9b9de76238
Instruction Fuzzy Hash: E3112A7AB18B5282E7098F69E4546AE73B0FB89B84F484471EE5D83798DF3CD445CB00

Function 00007FFDFAC00940 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFAC0095D
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC00968
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC009AF
PyGILState_Release.PYTHON313 ref: 00007FFDFAC009B7

Strings

Save, xrefs: 00007FFDFAC00989

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$DeallocEnsureFromObject_ReleaseU_object@@
String ID: Save
API String ID: 4093839183-4115961312
Opcode ID: 43e45fba48872af5e67a5766f29a849487808eed1c76cc8242a707e3c13e092d
Instruction ID: 21978fba7defc7ad55771266a90de64dd603732363d077810813ecb4227c2237
Opcode Fuzzy Hash: 43e45fba48872af5e67a5766f29a849487808eed1c76cc8242a707e3c13e092d
Instruction Fuzzy Hash: 0801393AB18B5282EB048F22E91466DB3A0FB49BA0F494071DE5D83B98DE3CD4548B40

Function 00007FFDFAC008A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFAC008BD
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC008C8
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC0090F
PyGILState_Release.PYTHON313 ref: 00007FFDFAC00917

Strings

Load, xrefs: 00007FFDFAC008E9

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$DeallocEnsureFromObject_ReleaseU_object@@
String ID: Load
API String ID: 4093839183-2234796835
Opcode ID: cd04774691088bb2c5a989e58d7f9fd3e7a29c4cb896ae34f0d85d1fa2dc603c
Instruction ID: b49599fb9f30c3732a8c79433308e93a00566d92592a4828868f77a138b44fa1
Opcode Fuzzy Hash: cd04774691088bb2c5a989e58d7f9fd3e7a29c4cb896ae34f0d85d1fa2dc603c
Instruction Fuzzy Hash: 1A011B3AB08B5692EB149F26E8146ADB3B0FB89B90F4A4071DE5D83B9DDF3CD5548700

Function 00007FFDFABD7AB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38threadcomCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABD7ABE
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD7AD9
OleInitialize.OLE32 ref: 00007FFDFABD7AE4
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD7AEF

Strings

:OleInitialize, xrefs: 00007FFDFABD7AB7

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Arg_InitializeParseRestoreSaveTuple
String ID: :OleInitialize
API String ID: 940585508-1252408737
Opcode ID: 616f53c1c1a5ee29d2add520433ecf284c314cd881e812c70a75b3f273b81255
Instruction ID: 9a81a85a47e264c8524d8f7255e330d31e503ea508fe4c4e89fbeb49c64b6e80
Opcode Fuzzy Hash: 616f53c1c1a5ee29d2add520433ecf284c314cd881e812c70a75b3f273b81255
Instruction Fuzzy Hash: E6011E39B18A4292EB0C9B26E86497D63E1FF8DB80FC805B5D95D877A8DE3CE1458700

Function 00007FFDFAC009E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFAC009F5
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FFDFAC00A00
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC00A43
PyGILState_Release.PYTHON313 ref: 00007FFDFAC00A4B

Strings

SaveCompleted, xrefs: 00007FFDFAC00A1D

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$DeallocEnsureFromObject_ReleaseU_object@@
String ID: SaveCompleted
API String ID: 4093839183-2006622397
Opcode ID: f4104ee9b264fa95982eb0e7ba8745b25176b618fc40db9593530c4d2db34522
Instruction ID: da68294961f176d67da89450e689e4d746efbb8c979dbd6fb86028ca8a200339
Opcode Fuzzy Hash: f4104ee9b264fa95982eb0e7ba8745b25176b618fc40db9593530c4d2db34522
Instruction Fuzzy Hash: 0C015E3EB08B5292EB088B26E82496D63A0FB84B90F498571DE5D83798DF3CD455C700

Function 00007FFDFABD1B6E Relevance: 7.6, APIs: 5, Instructions: 80threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1CEB
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1D11
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFABD1D2A
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1D63
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1DA3
CoTaskMemFree.OLE32 ref: 00007FFDFABD1DB3

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$FreeRestoreSave$Object_Task
String ID:
API String ID: 783668138-0
Opcode ID: a5e7344c7df7af1c22d1b9d3aeb0b02906fd267e2ce5cf8fe6e2180124cbb05e
Instruction ID: 9980ec5bdc5d7d398b1b9afe790df8a1d2d782a632182e618204b516d95a8086
Opcode Fuzzy Hash: a5e7344c7df7af1c22d1b9d3aeb0b02906fd267e2ce5cf8fe6e2180124cbb05e
Instruction Fuzzy Hash: E241F736608A8186DB58DB08E49472EB7B0FBD5B44F940075E79E87BA8CF7DD881CB00

Function 00007FFDFAC11AA0 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFAC11AB5
PyErr_NoMemory.PYTHON313 ref: 00007FFDFAC11AC0

Part of subcall function 00007FFDFAC118F0: PyLong_AsLong.PYTHON313 ref: 00007FFDFAC11920

VariantClear.OLEAUT32 ref: 00007FFDFAC11B32
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFAC11B3B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFAC11B4C

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: free$ClearErr_LongLong_MemoryVariantmalloc
String ID:
API String ID: 2176891292-0
Opcode ID: d3b98422f22c8a01cb1c549aa0a33762eb39c38d977fa6c205da2c2532438e27
Instruction ID: 513d78069c88b3c935b74b395c4da363bbfb8d28095ecfd7da9ee151bec8f460
Opcode Fuzzy Hash: d3b98422f22c8a01cb1c549aa0a33762eb39c38d977fa6c205da2c2532438e27
Instruction Fuzzy Hash: 0D215E36B09B8191EB498F16F464A7D77A0EF88F84B184478DB6E47789EE3CE8518700

Function 00007FFDFABD1B3C Relevance: 7.5, APIs: 5, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1CEB
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1D11
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFABD1D2A
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1D63
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1DA3
CoTaskMemFree.OLE32 ref: 00007FFDFABD1DB3

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$FreeRestoreSave$Object_Task
String ID:
API String ID: 783668138-0
Opcode ID: 48120cdf797f02399dbac96b29f52db69fe021154118b6418117f04479985125
Instruction ID: b36065a9e6766ac058c9c3e0e2c0055fac2fa353a4edbf259db5c8bd8426fc19
Opcode Fuzzy Hash: 48120cdf797f02399dbac96b29f52db69fe021154118b6418117f04479985125
Instruction Fuzzy Hash: B521E936708A4182E758DB08E49476EB7B0FBC5B44F540075EA9E837A8CF3DD895CB00

Function 00007FFDFABD1B5F Relevance: 7.5, APIs: 5, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1CEB
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1D11
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFABD1D2A
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1D63
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1DA3
CoTaskMemFree.OLE32 ref: 00007FFDFABD1DB3

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$FreeRestoreSave$Object_Task
String ID:
API String ID: 783668138-0
Opcode ID: 2a91899d05150e13e0db880a3080f8b649e490f06f91fc5ae8790163d9026421
Instruction ID: b36065a9e6766ac058c9c3e0e2c0055fac2fa353a4edbf259db5c8bd8426fc19
Opcode Fuzzy Hash: 2a91899d05150e13e0db880a3080f8b649e490f06f91fc5ae8790163d9026421
Instruction Fuzzy Hash: B521E936708A4182E758DB08E49476EB7B0FBC5B44F540075EA9E837A8CF3DD895CB00

Function 00007FFDFABD1933 Relevance: 7.5, APIs: 5, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1CEB
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1D11
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFABD1D2A
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1D63
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1DA3
CoTaskMemFree.OLE32 ref: 00007FFDFABD1DB3

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$FreeRestoreSave$Object_Task
String ID:
API String ID: 783668138-0
Opcode ID: af7475641ed73c52048dbe11d42fc1bb689ff7a3ef624c88c990dd8a62f40989
Instruction ID: b36065a9e6766ac058c9c3e0e2c0055fac2fa353a4edbf259db5c8bd8426fc19
Opcode Fuzzy Hash: af7475641ed73c52048dbe11d42fc1bb689ff7a3ef624c88c990dd8a62f40989
Instruction Fuzzy Hash: B521E936708A4182E758DB08E49476EB7B0FBC5B44F540075EA9E837A8CF3DD895CB00

Function 00007FFDFABD188E Relevance: 7.5, APIs: 5, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1CEB
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1D11
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFABD1D2A
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1D63
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1DA3
CoTaskMemFree.OLE32 ref: 00007FFDFABD1DB3

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$FreeRestoreSave$Object_Task
String ID:
API String ID: 783668138-0
Opcode ID: 820d6485c1b572dbe88501ffbc4fa96cc3d19f051fba35e38e1c8f818ff5b0b7
Instruction ID: b36065a9e6766ac058c9c3e0e2c0055fac2fa353a4edbf259db5c8bd8426fc19
Opcode Fuzzy Hash: 820d6485c1b572dbe88501ffbc4fa96cc3d19f051fba35e38e1c8f818ff5b0b7
Instruction Fuzzy Hash: B521E936708A4182E758DB08E49476EB7B0FBC5B44F540075EA9E837A8CF3DD895CB00

Function 00007FFDFABD1A58 Relevance: 7.5, APIs: 5, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1CEB
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1D11
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFABD1D2A
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1D63
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1DA3
CoTaskMemFree.OLE32 ref: 00007FFDFABD1DB3

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$FreeRestoreSave$Object_Task
String ID:
API String ID: 783668138-0
Opcode ID: a7524a524d510db184de8c67320380a9ac8b698b885440a96a883d836e445766
Instruction ID: b36065a9e6766ac058c9c3e0e2c0055fac2fa353a4edbf259db5c8bd8426fc19
Opcode Fuzzy Hash: a7524a524d510db184de8c67320380a9ac8b698b885440a96a883d836e445766
Instruction Fuzzy Hash: B521E936708A4182E758DB08E49476EB7B0FBC5B44F540075EA9E837A8CF3DD895CB00

Function 00007FFDFABD19EB Relevance: 7.5, APIs: 5, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1CEB
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1D11
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFABD1D2A
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1D63
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1DA3
CoTaskMemFree.OLE32 ref: 00007FFDFABD1DB3

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$FreeRestoreSave$Object_Task
String ID:
API String ID: 783668138-0
Opcode ID: 80e9636e4addcfeee93d01e0838a21b6e8ad91d9349d7261f5d25464bc70adbe
Instruction ID: b36065a9e6766ac058c9c3e0e2c0055fac2fa353a4edbf259db5c8bd8426fc19
Opcode Fuzzy Hash: 80e9636e4addcfeee93d01e0838a21b6e8ad91d9349d7261f5d25464bc70adbe
Instruction Fuzzy Hash: B521E936708A4182E758DB08E49476EB7B0FBC5B44F540075EA9E837A8CF3DD895CB00

Function 00007FFDFABD19BC Relevance: 7.5, APIs: 5, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1CEB
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1D11
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFABD1D2A
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1D63
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1DA3
CoTaskMemFree.OLE32 ref: 00007FFDFABD1DB3

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$FreeRestoreSave$Object_Task
String ID:
API String ID: 783668138-0
Opcode ID: ceba6d62563a6379fac60d3b3afa6352d36e8d975787c36c3831d34a2241f16e
Instruction ID: b36065a9e6766ac058c9c3e0e2c0055fac2fa353a4edbf259db5c8bd8426fc19
Opcode Fuzzy Hash: ceba6d62563a6379fac60d3b3afa6352d36e8d975787c36c3831d34a2241f16e
Instruction Fuzzy Hash: B521E936708A4182E758DB08E49476EB7B0FBC5B44F540075EA9E837A8CF3DD895CB00

Function 00007FFDFABD1965 Relevance: 7.5, APIs: 5, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1CEB
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1D11
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFABD1D2A
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1D63
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1DA3
CoTaskMemFree.OLE32 ref: 00007FFDFABD1DB3

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$FreeRestoreSave$Object_Task
String ID:
API String ID: 783668138-0
Opcode ID: a0f28905f09be49d079744fef972341d32de1ee8f3fd46900813776fd0338d08
Instruction ID: b36065a9e6766ac058c9c3e0e2c0055fac2fa353a4edbf259db5c8bd8426fc19
Opcode Fuzzy Hash: a0f28905f09be49d079744fef972341d32de1ee8f3fd46900813776fd0338d08
Instruction Fuzzy Hash: B521E936708A4182E758DB08E49476EB7B0FBC5B44F540075EA9E837A8CF3DD895CB00

Function 00007FFDFABD198F Relevance: 7.5, APIs: 5, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1CEB
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1D11
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FFDFABD1D2A
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABD1D63
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABD1DA3
CoTaskMemFree.OLE32 ref: 00007FFDFABD1DB3

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$FreeRestoreSave$Object_Task
String ID:
API String ID: 783668138-0
Opcode ID: 1863d7fca1b33f77bc0848a0a1c32ad60999d7da140397fd26f49327d848fe79
Instruction ID: b36065a9e6766ac058c9c3e0e2c0055fac2fa353a4edbf259db5c8bd8426fc19
Opcode Fuzzy Hash: 1863d7fca1b33f77bc0848a0a1c32ad60999d7da140397fd26f49327d848fe79
Instruction Fuzzy Hash: B521E936708A4182E758DB08E49476EB7B0FBC5B44F540075EA9E837A8CF3DD895CB00

Function 00007FFDFAC0EBF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC0EC2C
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0EC4B
PyErr_SetString.PYTHON313 ref: 00007FFDFAC0ECBA

Strings

The Python object is invalid, xrefs: 00007FFDFAC0ECAC

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSaveString
String ID: The Python object is invalid
API String ID: 695671107-2445808733
Opcode ID: 1e5bd2247a94a1d79e8dbaac90f30fe30660ed4b4f105412d304d0336757a857
Instruction ID: 376cb68a9c0ecbdc6f8f2e424e992c3616d195dcf82dce23ab2cf05a6a6a3f47
Opcode Fuzzy Hash: 1e5bd2247a94a1d79e8dbaac90f30fe30660ed4b4f105412d304d0336757a857
Instruction Fuzzy Hash: 2C21B029B19A5282EB589B15F52097E63B1EF88BC4F4951B2EE6D537DCCF2CE8418700

Function 00007FFDFABF6AB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFABF6ADB
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABF6AF3
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABF6B0B

Strings

The Python object is invalid, xrefs: 00007FFDFABF6ABB

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSaveString
String ID: The Python object is invalid
API String ID: 695671107-2445808733
Opcode ID: f2942db308436a91a1507b966a8e3c857c317641c98f2cfb1bfe3cd1b0da178d
Instruction ID: 12f3c2f8154277feb69ac219300dbf64f857eb2a55410ac4ac6025a597e34bb5
Opcode Fuzzy Hash: f2942db308436a91a1507b966a8e3c857c317641c98f2cfb1bfe3cd1b0da178d
Instruction Fuzzy Hash: 27114239B18AC182EB1D8B55E56447D63A1FF48BD0B4850B2DE2E477ECDE3CE4518700

Function 00007FFDFAC09900 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC0992B
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC09943
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC0995B

Strings

The Python object is invalid, xrefs: 00007FFDFAC0990B

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSaveString
String ID: The Python object is invalid
API String ID: 695671107-2445808733
Opcode ID: dc586786b49576c1de34849ebc0a0d7c37e00a99db0889586e40daced4b9d73d
Instruction ID: bdfe3f126f1bf33455aef5c343e4b302f69e622b81c056aa1a3e2e1e00b91a4c
Opcode Fuzzy Hash: dc586786b49576c1de34849ebc0a0d7c37e00a99db0889586e40daced4b9d73d
Instruction Fuzzy Hash: D511423DB1865182EB5D8B55E56457D63B0FF48BD0B4850B2DE6E877ECDE2CE4418700

Function 00007FFDFABF5C50 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABF5C6B
PyErr_SetString.PYTHON313 ref: 00007FFDFABF5C88

Strings

l:Skip, xrefs: 00007FFDFABF5C61
The Python object is invalid, xrefs: 00007FFDFABF5C7A

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Arg_Err_ParseStringTuple
String ID: The Python object is invalid$l:Skip
API String ID: 385655187-1306879369
Opcode ID: ba4ce1c3cc26001e6f54e9ff340dcaeb8876c3d9eb05f9768509cf874c3409c5
Instruction ID: 01a2111ea95b79d36a37e351a1a67398f29107d2e7d940fe25f076f4696dfaf9
Opcode Fuzzy Hash: ba4ce1c3cc26001e6f54e9ff340dcaeb8876c3d9eb05f9768509cf874c3409c5
Instruction Fuzzy Hash: 04113369B0864292FB0D9B65E46497923E1EF88B84B8941B1C92D473D8DE3CE441C200

Function 00007FFDFAC099B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFDFAC099DB
PyEval_SaveThread.PYTHON313 ref: 00007FFDFAC099EE
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFAC09A05

Strings

The Python object is invalid, xrefs: 00007FFDFAC099BB

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSaveString
String ID: The Python object is invalid
API String ID: 695671107-2445808733
Opcode ID: 9b1e5c274f0a52fd27a019495541032763af67f2712baae29a839784ee2747cd
Instruction ID: 2a6c5b78abe1945f2a4cdfd10b5d6ae757263c949506bd7200b2a84299b4dcf2
Opcode Fuzzy Hash: 9b1e5c274f0a52fd27a019495541032763af67f2712baae29a839784ee2747cd
Instruction Fuzzy Hash: DDF0316DB19A42C2FF0C9B65A8A453D63E1FF18B84B085471CA2D876E8DF2CD0958300

Function 00007FFDFABF0A30 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FFDFABF0A63
PyErr_SetString.PYTHON313 ref: 00007FFDFABF0A8C

Strings

td must be None, xrefs: 00007FFDFABF0A82
HOiii:FORMATETC, xrefs: 00007FFDFABF0A57

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Arg_Err_ParseStringTuple
String ID: HOiii:FORMATETC$td must be None
API String ID: 385655187-3711422910
Opcode ID: 0ea6e1a18ad9822b6dd0516befe3b0a45cf000ef1ce5333c7add702cbd90bca4
Instruction ID: e85251a7e6373829ad4b55fd0570cf5b2cbe68cb86f52fe37e12ac1007f51274
Opcode Fuzzy Hash: 0ea6e1a18ad9822b6dd0516befe3b0a45cf000ef1ce5333c7add702cbd90bca4
Instruction Fuzzy Hash: 9C0162A6B04B8291FB04CB54E450AA973E0FB44B84F884072D95D877B8EF7CD5D5C710

Function 00007FFDFAC16AA0 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON313 ref: 00007FFDFAC16ADB
PyDict_New.PYTHON313 ref: 00007FFDFAC16AE9
_Py_Dealloc.PYTHON313 ref: 00007FFDFAC16B04
PyTuple_SetItem.PYTHON313 ref: 00007FFDFAC16C16

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Tuple_$DeallocDict_Item
String ID:
API String ID: 4030228039-0
Opcode ID: 75126bdba81cdd180b33286ac62cedc838fece530eef8bf7169ba2c14301147b
Instruction ID: e5efd11173b074a65c2c4a4da306e43b565315e25619ac98b85f1bc1e53e7894
Opcode Fuzzy Hash: 75126bdba81cdd180b33286ac62cedc838fece530eef8bf7169ba2c14301147b
Instruction Fuzzy Hash: 66414B3A704B4196EB14CF65F96496DB3A4FB88794F458635DAAD437A8DF3CE005C700

Function 00007FFDFABC3F20 Relevance: 6.1, APIs: 4, Instructions: 66threadCOMMON

Download Yara Rule

APIs

CreateErrorInfo.OLEAUT32 ref: 00007FFDFABC3F3A
PyEval_SaveThread.PYTHON313 ref: 00007FFDFABC3FA2
PyEval_RestoreThread.PYTHON313 ref: 00007FFDFABC3FC7
SetErrorInfo.OLEAUT32 ref: 00007FFDFABC3FD8

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: ErrorEval_InfoThread$CreateRestoreSave
String ID:
API String ID: 4101529084-0
Opcode ID: cfcb6817ebd44ef5a3b8b0c10cf24590c0509fbadcdd8f52a91cc21044e7d9db
Instruction ID: e36a0fb1e971e068a80c436685dc25b63f5e9b828429bbdb41657040cc8d8b3a
Opcode Fuzzy Hash: cfcb6817ebd44ef5a3b8b0c10cf24590c0509fbadcdd8f52a91cc21044e7d9db
Instruction Fuzzy Hash: 8D21C97A704A4182DB049F2AE49452DA771FBC8FD5B658462EF5E47768CE3ED844C700

Function 00007FFDFA9C0504 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFDFA9C0530
GetCurrentThreadId.KERNEL32 ref: 00007FFDFA9C053E
GetCurrentProcessId.KERNEL32 ref: 00007FFDFA9C054A
QueryPerformanceCounter.KERNEL32 ref: 00007FFDFA9C055A

Memory Dump Source

Source File: 00000001.00000002.2946946762.00007FFDFA441000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFDFA440000, based on PE: true

Associated: 00000001.00000002.2946913655.00007FFDFA440000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2947587275.00007FFDFA9DA000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2947717904.00007FFDFAB5F000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2947759808.00007FFDFAB65000.00000008.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2947785124.00007FFDFAB67000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2947809766.00007FFDFAB6D000.00000008.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2947836050.00007FFDFAB6E000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000001.00000002.2947860733.00007FFDFAB72000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfa440000_UpdaterTool.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: beceb9d99cd86d4124f4c4e6ac7526b31cb8b8c9be067b383abdb293bdb3ff0d
Instruction ID: a735c4e99acc82ceb581095f9e9a023a1eac5fc868935315848bf1a7f4753db2
Opcode Fuzzy Hash: beceb9d99cd86d4124f4c4e6ac7526b31cb8b8c9be067b383abdb293bdb3ff0d
Instruction Fuzzy Hash: 75113026B14F018AEB00CF61E8646B833B4F719B58F840E75DA7D86BA8DF78D1A48340

Function 00007FFDFABC4AF0 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

PyErr_Fetch.PYTHON313 ref: 00007FFDFABC4B16
PyErr_NormalizeException.PYTHON313 ref: 00007FFDFABC4B35
PyErr_GivenExceptionMatches.PYTHON313 ref: 00007FFDFABC4B4A
PyErr_Restore.PYTHON313 ref: 00007FFDFABC4B74

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Err_$Exception$FetchGivenMatchesNormalizeRestore
String ID:
API String ID: 2089906250-0
Opcode ID: 53ee736984633b283623d2ca35dd044706e998d2c2ea061dfb4dc42915074f85
Instruction ID: 5c82e0c11bf4a85a57c483934624b0637faa512557aef02523cf2072f2c9361e
Opcode Fuzzy Hash: 53ee736984633b283623d2ca35dd044706e998d2c2ea061dfb4dc42915074f85
Instruction Fuzzy Hash: C8010066729A4192EB448F05E4949AAB360FBC5B90F445072EE9E43A98DF3DD545C700

Function 00007FFDFAC128E3 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 00007FFDFAC128E7
GlobalSize.KERNEL32 ref: 00007FFDFAC128F9
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFDFAC12905
GlobalUnlock.KERNEL32 ref: 00007FFDFAC12912

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Global$Size$Bytes_FromLockStringUnlock
String ID:
API String ID: 911184104-0
Opcode ID: 29b85938cf0b3a91f0d98d1f346e26298622598660a1be10a37f41af03a5a3b4
Instruction ID: 57acbd228f5015cb44b4b35f6f183cc400ccb175799363feec3c20e2b5f1243f
Opcode Fuzzy Hash: 29b85938cf0b3a91f0d98d1f346e26298622598660a1be10a37f41af03a5a3b4
Instruction Fuzzy Hash: FAF0FF3DB09A02A6EB589F16E46453C63A0FB48F94B0804B1CF2E873D8DE2CE4909300

Function 00007FFDFAC13910 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

_Py_NewReference.PYTHON313 ref: 00007FFDFAC1392B
PyLong_FromLong.PYTHON313 ref: 00007FFDFAC13954

Part of subcall function 00007FFDFAC11FC0: Py_BuildValue.PYTHON313 ref: 00007FFDFAC1201F
Part of subcall function 00007FFDFAC11FC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFAC12036
Part of subcall function 00007FFDFAC11FC0: _Py_Dealloc.PYTHON313 ref: 00007FFDFAC1204A

Strings

PyVARDESC ctor has unknown varkind (%d) - returning None, xrefs: 00007FFDFAC139E4

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: Dealloc$BuildFromLongLong_ReferenceValue
String ID: PyVARDESC ctor has unknown varkind (%d) - returning None
API String ID: 857882782-2090549355
Opcode ID: 09f1b1b397e2ababb9029e309dc222d71feba5eb567c9fa76d0930032f86a32b
Instruction ID: e13cba223c931199b61a7f5f794bd749c5bef87892fe22966952088a209524a3
Opcode Fuzzy Hash: 09f1b1b397e2ababb9029e309dc222d71feba5eb567c9fa76d0930032f86a32b
Instruction Fuzzy Hash: 0721907AB09A41A6E7588F29D46193C37B0FB08B88B544571DA6E837D8DF3CE4A1CB40

Function 00007FFDFAC16A10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PyObject_SetAttrString.PYTHON313(?,?,?,00007FFDFABCAEF6), ref: 00007FFDFAC16A5E
_Py_Dealloc.PYTHON313(?,?,?,00007FFDFABCAEF6), ref: 00007FFDFAC16A77

Strings

value, xrefs: 00007FFDFAC16A57

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: AttrDeallocObject_String
String ID: value
API String ID: 2855338292-494360628
Opcode ID: 329f5dabfb3af3e27921c76b4f254d2a3cda406b5cdd589a3693cce0bcaa62a3
Instruction ID: 7d49d0a65fe32684961aca1c18e638ba031a7e493610ad0940f23cb631fcd67b
Opcode Fuzzy Hash: 329f5dabfb3af3e27921c76b4f254d2a3cda406b5cdd589a3693cce0bcaa62a3
Instruction Fuzzy Hash: DD019E6AB0564295EB998F26E46073C32E0EF08B98F48C471DB6D863D8DF3CD4928B00

Function 00007FFDFAC0CBF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFAC0CC04
PyGILState_Release.PYTHON313 ref: 00007FFDFAC0CC34

Strings

Commit, xrefs: 00007FFDFAC0CC20

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: Commit
API String ID: 715727267-1232612251
Opcode ID: bb559d96f6e3e9a0462d0597566b60fb6560431c072bac3f22584261cf4cf6f8
Instruction ID: 381cb0d0c485a5b3e7398ed13ff02e8c9649d164aa61277bcf8ad848b9dc9786
Opcode Fuzzy Hash: bb559d96f6e3e9a0462d0597566b60fb6560431c072bac3f22584261cf4cf6f8
Instruction Fuzzy Hash: BEF05E3AB14B6592EB008F29E41455DA3B0FB88B94F444572DF9C83758DF3CD445CB40

Function 00007FFDFABF9990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABF99A4
PyGILState_Release.PYTHON313 ref: 00007FFDFABF99D4

Strings

Skip, xrefs: 00007FFDFABF99C0

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: Skip
API String ID: 715727267-1480915523
Opcode ID: a2723dbc9738e0f958670cf5bbb05955224aa9e659b899422e69c5b71d37cf5c
Instruction ID: dbf1d60db614c5565e7637526e809ee7483c04157160d0623bf613f531b86e14
Opcode Fuzzy Hash: a2723dbc9738e0f958670cf5bbb05955224aa9e659b899422e69c5b71d37cf5c
Instruction Fuzzy Hash: 41F05E3AB14B6592EB008F29E41455DA3B0FB88B94F444572DF5C83758DF3CD446CB40

Function 00007FFDFABFFF40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABFFF54
PyGILState_Release.PYTHON313 ref: 00007FFDFABFFF84

Strings

ContextSensitiveHelp, xrefs: 00007FFDFABFFF70

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: ContextSensitiveHelp
API String ID: 715727267-4110576620
Opcode ID: 5f0dd99ab47ecc7509ba3c6f4d436b5d1ddde4d4baa7bb723593fd628b7c245c
Instruction ID: deb5690f9e574bfb62bf41aa9b47ddb7a8a37897ac896b06b8e2460d481be8bd
Opcode Fuzzy Hash: 5f0dd99ab47ecc7509ba3c6f4d436b5d1ddde4d4baa7bb723593fd628b7c245c
Instruction Fuzzy Hash: 46F05E3AB18B6192EB008F29E45455DA3B0FB88B94F444572DF5C83758DF3CD445CB00

Function 00007FFDFABE5B50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABE5B5D
PyGILState_Release.PYTHON313 ref: 00007FFDFABE5B85

Strings

InitNew, xrefs: 00007FFDFABE5B6E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: InitNew
API String ID: 715727267-2727442622
Opcode ID: 7c39560557e6c16cd57088573f9a5b61df3d3829fc9fd4e846c6f273f1d1cd45
Instruction ID: 766b35b1135b609c4ae062abc378d285820915e2605d86e4511fead5a77058f2
Opcode Fuzzy Hash: 7c39560557e6c16cd57088573f9a5b61df3d3829fc9fd4e846c6f273f1d1cd45
Instruction Fuzzy Hash: F2E09226B1464192FB045B79F458E6C63A0FB4CB94F855030DA1987658DE38C8898700

Function 00007FFDFAC0CC50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFAC0CC5D
PyGILState_Release.PYTHON313 ref: 00007FFDFAC0CC89

Strings

Revert, xrefs: 00007FFDFAC0CC75

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: Revert
API String ID: 715727267-3951012024
Opcode ID: 107139c2922147c0244aaa30d2459918268bbc9e9dbd80e09f1554ab39fe157a
Instruction ID: 9ea83d9c8ac09c98205e915d646e72412d3043229c9530c6ff64158eb76c08e2
Opcode Fuzzy Hash: 107139c2922147c0244aaa30d2459918268bbc9e9dbd80e09f1554ab39fe157a
Instruction Fuzzy Hash: BEE06D2AB24A1692EB049F79E46896CA3A0FB88B84F444031DE1983258DE3CD449C700

Function 00007FFDFAC09C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFAC09C4D
PyGILState_Release.PYTHON313 ref: 00007FFDFAC09C75

Strings

ImpersonateClient, xrefs: 00007FFDFAC09C5E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: ImpersonateClient
API String ID: 715727267-2247024987
Opcode ID: 32efda8d082c7b17451cd9707033824ed3465b7637c454f25efe1f3b3f68347e
Instruction ID: 7e497fe2ea51ee8842130fbd42d1f60959275c7fdd059c89feac6a073b537ce8
Opcode Fuzzy Hash: 32efda8d082c7b17451cd9707033824ed3465b7637c454f25efe1f3b3f68347e
Instruction Fuzzy Hash: A6E09226F2475192EB045B79F498A6C63E0FB4CB84F455030DA1987648DD38C4898700

Function 00007FFDFABE6BE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABE6BED
PyGILState_Release.PYTHON313 ref: 00007FFDFABE6C15

Strings

InitNew, xrefs: 00007FFDFABE6BFE

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: InitNew
API String ID: 715727267-2727442622
Opcode ID: 5fd2c5972e1855b30a111cf3b688e0f57dbf539a87d9a5a3d447952757edb853
Instruction ID: 0f1abcf0226cb11ecabfb0e7c19191ea2a379dadb2643e372bc44b34b337943f
Opcode Fuzzy Hash: 5fd2c5972e1855b30a111cf3b688e0f57dbf539a87d9a5a3d447952757edb853
Instruction Fuzzy Hash: A0E09226B14641D2FB145B79F458E6C63A0FB4CB94F855034DE1987648DE38C4898700

Function 00007FFDFABF99F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABF99FD
PyGILState_Release.PYTHON313 ref: 00007FFDFABF9A25

Strings

Reset, xrefs: 00007FFDFABF9A0E

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: Reset
API String ID: 715727267-2438762569
Opcode ID: 4785bdd762219671f94352680cd682db7f155cbab4864aa85b1894574415fc8d
Instruction ID: cdabe090184b82bc920382722fc1aa463204dcd7cfa6521dcb7e905111333b0d
Opcode Fuzzy Hash: 4785bdd762219671f94352680cd682db7f155cbab4864aa85b1894574415fc8d
Instruction Fuzzy Hash: 17E09226B2465192EB045B79F498A6C63A0FB9CB84F855030DE5987648DD38C4498700

Function 00007FFDFABE8EE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FFDFABE8EED
PyGILState_Release.PYTHON313 ref: 00007FFDFABE8F15

Strings

TestCancel, xrefs: 00007FFDFABE8EFE

Memory Dump Source

Source File: 00000001.00000002.2947952810.00007FFDFABC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFDFABC0000, based on PE: true

Associated: 00000001.00000002.2947925633.00007FFDFABC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948064051.00007FFDFAC1E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948106543.00007FFDFAC51000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948150812.00007FFDFAC5C000.00000008.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948190664.00007FFDFAC5D000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000001.00000002.2948219406.00007FFDFAC66000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfabc0000_UpdaterTool.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: TestCancel
API String ID: 715727267-2667677955
Opcode ID: 72a07e46d1725cc4311d63012877321eae4685f0f2c13b376de30b10d1e6beb8
Instruction ID: cb2d4bb32a4676e222493941da3eb22cbe23cb8885d5c7f7e820f6ed0832b537
Opcode Fuzzy Hash: 72a07e46d1725cc4311d63012877321eae4685f0f2c13b376de30b10d1e6beb8
Instruction Fuzzy Hash: 13E09226B2465192EB049B79F498E6C63A0FB4CB84F855030DE1987648DD38C4898700

Input	Output
URL: https://alert-metamask.info/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Dear MetaMask user, our system has detected suspicious activity indicating an attempted unauthorized access to your credentials. We strongly recommend that you immediately change your wallet password.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://alert-metamask.info Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://alert-metamask.info
URL: https://alert-metamask.info/ Model: Joe Sandbox AI	{ "brands": [ "MetaMask" ] }
	{ "brands": [ "MetaMask" ] }

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UpdaterTool.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin\mfc140u.dll

C:\Users\user\AppData\Local\Temp\_MEI74322\Pythonwin\win32ui.pyd

C:\Users\user\AppData\Local\Temp\_MEI74322\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI74322\VCRUNTIME140_1.dll

C:\Users\user\AppData\Local\Temp\_MEI74322\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI74322\_cffi_backend.cp313-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI74322\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI74322\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI74322\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI74322\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI74322\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI74322\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI74322\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI74322\_wmi.pyd

Windows Analysis Report
UpdaterTool.exe

C:\Users\user\AppData\Local\Temp\gen_py\3.13\init.py

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre